Examkin

Question

Difficulty: MediumCreating and Managing Service Accounts

An operations team is auditing security compliance for a project in Google Cloud. During the audit, they discover that a developer generated a user-managed JSON service account key for local testing, which violates the organization's credential management policy. The team needs to immediately neutralize this specific compromised credential file without disabling the service account itself, as other production workloads rely on the service account. Which action should the operations team take?

  1. Delete the specific user-managed key using the gcloud iam service-accounts keys delete command or Google Cloud Console.Answer
  2. B
    Disable the service account, export a new JSON key file, and re-enable the service account.
  3. C
    Remove the IAM role bindings from the parent resource hierarchy folder to override key validity.
  4. D
    Demote the service account's permission level from Project Owner to Project Viewer so that existing keys expire.

Answer

Delete the specific user-managed key using the gcloud iam service-accounts keys delete command or Google Cloud Console.
Deleting the specific service account key directly revokes the public/private key pair associated with the JSON file without altering the service account identity or disrupting other resources using different authentication mechanisms.

Step-by-Step Solution

1
Identify the security requirement
The target credential (the user-managed JSON key) must be invalidated without disrupting the service account itself.
Production workloads still depend on the underlying service account identity.
2
Evaluate key management lifecycle operations in Google Cloud IAM
Service account keys are managed independently of the service account resource.
Deleting a specific key ID permanently revokes authentication attempts using that private key file while preserving the identity.
3
Select the appropriate CLI/Console management action
Execute key deletion via `gcloud iam service-accounts keys delete KEY_ID --iam-account=SA_EMAIL`.
This directly revokes the compromised credential while keeping active workloads running.

Key Concept

Service Account Key Lifecycle and Management
Rate this question

Topics

Creating and Managing Service Accounts

More questions from this topic