Exam Associate-Cloud-Engineer Topic 3 Question 350 Discussion

Actual exam question for Google's Associate-Cloud-Engineer exam
Question #: 350
Topic #: 3
You have an application that reads data from a Pub/Sub topic. During local development, you authenticated using your personal credentials to test the application. You now want to deploy the application to Vertex AI and have created a new service account to be used as the application ' s identity. You need to ensure that the deployed application can still access the Pub/Sub topic. What should you do?

Suggested Answer: B Vote an answer

The correct answer is B because production workloads should authenticate using their attached service account identity, not a developer's personal credentials or manually stored tokens. When deploying to Vertex AI, the service account used by the application must be granted the required Pub/Sub permissions, such as permissions to subscribe to or consume messages from the relevant topic or subscription. This follows least privilege and keeps access auditable at the service account level.
Extracting and storing a user access token is insecure because tokens expire and are tied to a person.
Secret Manager should not be used to store personal credentials for application runtime access. JSON private keys are also discouraged because they create long-lived credentials that increase operational and security risk.

by Jack at Oct 26, 2026, 12:08 PM

Limited Time Offer

15%

Off

Get Premium Associate-Cloud-Engineer Questions as Interactive Self Test Engine or PDF

Comments

Chosen Answer:
This is a voting comment (?) , you can switch to a simple comment.
Switch to a voting comment New
Nick name: Submit Cancel
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
0
0
0
10