Google Cloud Certified Professional Cloud Security Engineer Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• 1

  A and B are wrong Service Account User is use to grant someone the ability to impersonate a service account (ref: https://cloud.google.com/iam/docs/understanding-roles) So with those solution, the user could do some actions as the newly created service account We want the opposite: the service account need to do some actions as some user => D is the only working solution

• Chose D1

  Option A is false because it does not address the requirement of accessing a user's Google Drive on their behalf without relying on the user's credentials. Instead, option D, which involves granting domain-wide delegation to a service account for impersonation, is the recommended approach for this scenario.

• 1

  I'm not sure if D is the correct answer. The question specifically states that they want to follow Google-recommended practices and https://cloud.google.com/iam/docs/best-practices-service-accounts#domain-wide-delegation states to avoid domain-wide delegation. I do agree that D is the only way a service account can impersonate the user though