Security is the highest-priority topic in Google Cloud certification exams and enterprise technical interviews. This guide breaks down 10 critical IAM, Service Account key security, and VPC Service Controls questions with architectural diagrams and CLI verification examples.
Q1: What is the risk of downloading service account JSON keys, and how do you mitigate it?
Service account JSON keys are long-lived credentials that cannot be easily audited if leaked outside GCP perimeters. Mitigate this by disabling key creation via Organization Policy (iam.disableServiceAccountKeyCreation) and utilizing Workload Identity Federation or Short-Lived OAuth Access Tokens instead.