Your organization is currently updating an existing corporate application that is running in another public cloud to access managed database services in Google Cloud. The application will remain in th

Question

Options

• AUse workload identity federation to impersonate a service account.
• BAsk existing users to set their Google password to match their corporate password.
• CMigrate the application to Google Cloud, and use Identity and Access Management (IAM).
• DUse Google Workspace Password Sync to replicate passwords into Google Cloud.

• A
  71% (25)
• B
  6% (2)
• C
  9% (3)
• D
  14% (5)

Explanation

Options B and D address human user password management, which is irrelevant here - this is about authenticating a workload (an application) to GCP services, not human users. Option C requires migrating the application to GCP, which directly contradicts the stated constraint that the application will remain in another public cloud. Option A is correct and aligns with Google's recommended practices: Workload Identity Federation allows applications running outside of GCP (such as on AWS, Azure, or on-premises) to authenticate to Google Cloud services by exchanging their existing identity provider's token (e.g., an AWS IAM role token or Azure Managed Identity token) for a short-lived GCP credential used to impersonate a service account. This eliminates the need to create, distribute, and rotate long-lived service account key files, reduces security risk, requires no changes to how users authenticate, and minimizes disruption during the migration.

No community discussion yet for this question.