You plan to deploy your cloud infrastructure using a CI/CD cluster hosted on Compute Engine. You want to minimize the risk of its credentials being stolen by a third party. What should you do?

The correct answer is C. Create a custom service account for the cluster. Enable the. Disable service account key creation You can use the iam.disableServiceAccountKeyCreation boolean constraint to disable the creation of new external service account keys. This allows you to control the use of unmanaged long-term credentials for service accounts. When this…

Submitted by rachelw· Apr 18, 2026Configuring access within a cloud solution environment

Question

You plan to deploy your cloud infrastructure using a CI/CD cluster hosted on Compute Engine. You want to minimize the risk of its credentials being stolen by a third party. What should you do?

Options

ACreate a dedicated Cloud Identity user account for the cluster. Use a strong self-hosted vault
BCreate a dedicated Cloud Identity user account for the cluster. Enable the
CCreate a custom service account for the cluster. Enable the
DCreate a custom service account for the cluster. Enable the

How the community answered

(35 responses)

A
6% (2)
B
3% (1)
C
89% (31)
D
3% (1)

Explanation

Disable service account key creation You can use the iam.disableServiceAccountKeyCreation boolean constraint to disable the creation of new external service account keys. This allows you to control the use of unmanaged long-term credentials for service accounts. When this constraint is set, user-managed credentials cannot be created for service accounts in projects affected by the constraint. https://cloud.google.com/resource-manager/docs/organization-policy/restricting-service- accounts#example_policy_boolean_constraint

Topics

#Service Accounts#IAM#Compute Engine Security#Credential Management

Community Discussion

No community discussion yet for this question.

Full PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice