Authenticating On-Premises Apps to GCP AutoML APIs
Managing service accounts.
Managing Identity and Access Management (IAM).
You are building an application that will run in your data center. The application will use Google Cloud Platform (GCP) services like AutoML. You created a service account that has appropriate access to AutoML. You need to enable authentication to the APIs from your on-premises environment. What should you do?
Answer
Correct answer: B — Run gcloud to create a key file for the AutoML service account so your data-center application can authenticate its Google Cloud API calls.
Community Insight
The question tests how a service account authenticates from off-cloud: public/private key pairs are the mechanism, and the trap is choosing a vague 'use credentials' option or a networking fix instead of the actual key-creation step.
When an application running outside Google Cloud (such as in your own data center) must call AutoML or other GCP APIs, the service account's identity has to be established externally. This page shows that the correct move is to generate a service account key pair with gcloud, giving the on-premises app a private key it can present to Google's OAuth 2.0 token endpoint.
Option A is the most commonly defended wrong choice: 'use service account credentials' describes an outcome, not an action, and without first creating a key file there are no portable credentials to hand to the on-premises application. Options C and D are also wrong — interconnect provides connectivity, not identity, and a user account with mirrored permissions breaks the principle of least privilege and audit separation.
Community Discussion (43 comments)
838f01a
👍 1
Selected: A
Why A is correct The scenario is: Application runs on-premises. Application needs to call Google Cloud APIs (e.g., AutoML). A service account already exists with the required permissions. Need to authenticate from outside Google Cloud. Google's recommended approach is to use Application Default Credentials (ADC) with a service account credential file available to the application. In exam terms, the expected answer is: Use service account credentials in your on-premises application. This allows the application to authenticate as the service account and access AutoML using the permissions already granted to that account.
85c887f
👍 3
Selected: A
Correct answer should be A. "Use service account credentials", so here "credentials" indicate that we will use JSON key file in our on-premises application, and it is a correct way to authenticate from on-premises to APIs. The B option just says how to create this file, and it misses the next step for what to do next to achieve an authentication. In option A and B we will have the same JSON key file, but only option A contains full way to accomplish the task.
thewalker
👍 4
Selected: B
B As per the documentation: https://cloud.google.com/iam/docs/keys-create-delete#creating
BAofBK
👍 1
The correct answer is B
drinkwater
👍 1
A. Use service account credentials in your on-premises application. Explanation: Service accounts are the recommended way to authenticate your application and authorize it to access GCP services. You can create and use service account credentials to authenticate your application running in your on-premises environment and access GCP services like AutoML. Option B (using gcloud to create a key file for the service account) is a valid approach to generate credentials for a service account, but using those credentials in your application is essential, which aligns with option A. Options C and D are not directly related to enabling authentication for on-premises applications using service account credentials. Setting up direct interconnect (option C) is about networking, and granting permissions to a user account (option D) is not the standard approach for authenticating an application running on-premises to GCP services
Captain1212
👍 1
Selected: B
B is the correct answer, as to access the out side the google cloud , you need the key
Buruguduystunstugudunstuy
👍 7
Selected: B
The recommended approach for enabling authentication from an on-premises environment to Google Cloud Platform (GCP) services like AutoML is to use a service account and generate a JSON key file for the service account. This key file can then be used to authenticate and authorize API calls from your on-premises environment to GCP. Therefore, the correct answer is B. Use gcloud to create a key file for the service account that has appropriate permissions.
Bobbybash
👍 2
Selected: A
A. Use service account credentials in your on-premises application. To enable authentication to GCP services from your on-premises environment, you can use service account credentials in your on-premises application. This involves creating a service account that has appropriate access to the required GCP services, downloading the service account key file, and using the key file to authenticate the API requests in your on-premises application. This is a secure way to authenticate to GCP services as it does not require direct access to your GCP project or credentials from your on-premises environment.
Buruguduystunstugudunstuy
👍 3
Cloud Security/Auditor doesn't like Answer "A". Using service account credentials in your on-premises application could be a security risk if the credentials are compromised. If the key file is stolen or leaked, an attacker could use it to access your GCP resources, potentially causing data breaches, service disruptions, or financial losses. I would select Answer "B". Use gcloud to create a key file for the service account that has appropriate permissions and let Security Auditor stay away from my back. Never-ending "You cannot do this, you cannot do that" on Answer A.
cslince
👍 1
Selected: B
B it is.
mvk2022
👍 1
Selected: B
B it is.
Kopy
👍 1
Selected: B
Correct answer should be (B):
AzureDP900
👍 4
B is right To use a service account from outside of Google Cloud, such as on other platforms or on-premises, you must first establish the identity of the service account. Public/private key pairs provide a secure way of accomplishing this goal. When you create a service account key, the public portion is stored on Google Cloud, while the private portion is available only to you. For more information about public/private key pairs, see Service account keys.
haroldbenites
👍 1
Go for B
NoniGeorge
👍 1
Selected: B
Even thought A and B seem to be doing the same thing the best practice is to create a key so B is the right answer !
vishnukumartr
👍 3
B. Use gcloud to create a key file for the service account that has appropriate permissions.
shawnkkk
👍 3
B. Use gcloud to create a key file for the service account that has appropriate permissions.
Vivekvkt123
👍 3
Why not A? Aren't A and B getting the same key file?
jabrrJ68w02ond1
👍 1
A is not really telling you the steps to accomplish the task, it's only telling you the result of it (creating a SA with sufficient permissions and then use Console / gcloud to create a JSON token for it)
sunilw
👍 3
B is correct. Creating service account keys To use a service account from outside of Google Cloud, such as on other platforms or on-premises, you must first establish the identity of the service account. Public/private key pairs provide a secure way of accomplishing this goal. When you create a service account key, the public portion is stored on Google Cloud, while the private portion is available only to you. For more information about public/private key pairs, see Service account keys.
arsh1916
👍 1
B is correct
mcaromit
👍 1
B is correct as a 1st step...the key file is to be referenced in the env variable GOOGLE_APPLICATION_CREDENTIALS which would then provide access to on-prem application using ADC library
nliaustemac
👍 1
B. is the correct answer: Use gcloud to create a key file for the service account that has appropriate permissions.
GCP_Student1
👍 2
B. Use gcloud to create a key file for the service account that has appropriate permissions.
lutoa
👍 2
I think it is B. I have seen other variations on this question where the scenario specifies that the on-premise has no internet, in which case interconnect is required. This question does NOT specify, and since it is using API connection (so HTTP) it must have internet so the JSON key should be fine in answer B.
DucSiu
👍 1
B. Use gcloud to create a key file for the service account that has appropriate permissions.
DucSiu
👍 1
D. In the cluster's definition in Deployment Manager, add a metadata that has kube-system as key and the DaemonSet manifest as value.
victory108
👍 1
B - Use gcloud to create a key file for the service account that has appropriate permissions.
DucSiu
👍 1
B = 100%
Bhagirathi
👍 1
B = 100%
swatititame
👍 1
• B. Use gcloud to create a key file for the service account that has appropriate permissions.
nwk
👍 1
B, should use key file
glam
👍 3
B. Use gcloud to create a key file for the service account that has appropriate permissions.
ESP_SAP
👍 55
Correct answer should be (B): To use a service account outside of Google Cloud, such as on other platforms or on-premises, you must first establish the identity of the service account. Public/private key pairs provide a secure way of accomplishing this goal. https://cloud.google.com/iam/docs/creating-managing-service-account-keys
francisco_guerra
👍 1
The answer is B: Accessing private data on behalf of a service account outside Google Cloud environments Service account key You need to create a service account, and download its private key as a JSON file. You need to pass the file to Google Cloud Client Libraries, so they can generate the service account credentials at runtime.
Ale1973
👍 3
I think that B is the right answer for the same reason. My mental map is: B resolve the requirement, and yes, C is a prerequisite for B, but only C doesn't solve the scenery.
XRiddlerX
👍 3
The Answer is B. https://cloud.google.com/anthos/gke/docs/on-prem/how-to/service-accounts#create_service_accounts This section shows how to create the service accounts that you need to install and use GKE on-prem. It also shows how to create JSON key files for your service accounts and how to grant the appropriate IAM roles to your service accounts.
XRiddlerX
👍 3
After reading this again, yes B is a need but only AFTER the Interconnect is setup. I'm changing my answer to C.
filco72
👍 3
I Opt for B as per: https://cloud.google.com/docs/authentication#strategies
gtlranjan
👍 4
B is true
DarioFama23
👍 2
i think C
nitinz
👍 1
Wow, just for this small thing make interconnect? B will do the job just fine.
spudleymcdudley
👍 18
Nobody else does. It's B
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option B is correct because a service account is an identity that lives inside Google Cloud, and anything running on-premises must first prove which service account it is. Google's official guidance is explicit: "To use a service account outside of Google Cloud, such as on other platforms or on-premises, you must first establish the identity of the service account. Public/private key pairs provide a secure way of accomplishing this goal." Runninggcloud iam service-accounts keys create produces a JSON key file whose private half is held only by you and whose public half is stored by Google; the AutoML client in your data center uses that key to obtain an access token. This directly satisfies the requirement and is the documented pattern for external workload identity federation's predecessor.Why the Other Options Are Wrong
Option A names the end state but not the required action — you cannot "use service account credentials" until those credentials exist, and the only way to materialize them off-cloud is to create a key, so A is incomplete and B strictly subsumes it. Option C confuses transport with authentication: Dedicated Interconnect or Peering may be desirable for latency or private connectivity, but an on-premises link never establishes a service account's identity or issues tokens. Option D is actively harmful — granting a human user account parallel permissions and signing in with it introduces interactive credentials, weakens auditability, violates least privilege, and Google recommends avoiding user-account keys entirely for server workloads. As ESP_SAP cited from the documentation, key pairs are the supported mechanism, and commenters quoting the same page arrived at B independently.Community Comment Notes
The community is essentially unanimous on B, with ESP_SAP, Buruguduystunstugudunstu, thewalker and others quoting the service-account-keys documentation verbatim, including the line "Public/private key pairs provide a secure way of accomplishing this goal." One dissenting voice argued for A on the grounds that credentials implies the JSON key, but as 85c887f's counterargument concedes, option B is the step that actually produces them. Buruguduystunstugudunstu also warns that "Using service account credentials in your on-premises application could be a security risk if the credentials are compromised," which is a fair caution: key files must be rotated and vaulted, and modern guidance prefers short-lived workload identity federation where available.Official Reference
Exam Strategy
On ACE questions, when an app lives off-GCP and must call an API, look for the option that creates a service account key pair — that is the sanctioned identity-establishment step. Ignore any option that offers network plumbing or user accounts, since neither answers the authentication question.
Frequently Asked Questions
Why isn't option A correct if it also mentions using service account credentials?
Option A describes the desired end state but never establishes how those credentials are obtained off-cloud. Without generating a key pair first, the on-premises application has nothing to authenticate with, making B the actionable answer.
Doesn't Cloud Interconnect or Dedicated Interconnect let my data center reach GCP APIs securely?
Interconnect provides network connectivity and private routing, not identity. Authentication to AutoML still requires the service account to present a key-derived access token, so option C answers the wrong problem.
Related Analysis
Practice All ACE Questions
Access 84 questions with complete answers and detailed explanations.
View Full ACE Practice Test →