How to Grant Secure Cross-Cloud Access Using Short-Lived Credentials?

PCSE By islever Editorial Last updated

Short answer

C Configure a workload identity pool and provider to exchange external tokens for short-lived Google Cloud credentials.

Question

Your organization has applications that run in multiple clouds. The applications require access to a Google Cloud resource running in your project. You must use short-lived access credentials to maintain security across the clouds. What should you do?
  1. Create a managed workload identity. Bind an attested identity to the Compute Engine workload.
  2. Create a service account key. Download the key to each application that requires access to the Google Cloud resource.
  3. Create a workload identity pool with a workload identity provider for each external cloud. Set up a service account and add an IAM binding for impersonation. Correct Answer
  4. Create a VPC firewall rule for ingress traffic with an allowlist of the IP ranges of the external cloud applications.

Key Takeaways

Examines Workload Identity Federation for cross-cloud authentication while testing the common trap of choosing long-lived service account keys for security-critical scenarios.

This question tests securing multi-cloud application access to Google Cloud resources using short-lived tokens via Workload Identity Federation. Community consensus confirms option C as the secure, scalable solution that eliminates long-lived key management.

Common mistake: Option B is frequently selected because downloading service account keys appears simpler, but it violates security best practices by creating static, long-lived credentials prone to leakage.

Expert Analysis

Why the Answer Is Correct

Workload Identity Federation enables external workloads to authenticate directly without storing static keys. By configuring a workload identity pool and provider for each external cloud, you can exchange external tokens for Google Cloud short-lived access credentials. This architecture aligns perfectly with the requirement for temporary, highly secure tokens across distributed environments.

Why the Other Options Are Wrong

Option A incorrectly applies Compute Engine-specific workload identity features to external multi-cloud applications. Option B relies on long-lived service account keys, which contradicts the explicit requirement for short-lived credentials and increases breach risk. Option D focuses solely on network-level firewall rules, which cannot handle identity-based authentication or token generation.

Community Comment Notes

Multiple users confirmed C as correct, emphasizing that Workload Identity Federation replaces insecure key downloads with dynamic token exchange. Comments highlight how scoped access policies and IAM impersonation bindings securely delegate permissions without persisting secrets. One dissenting vote for Option A was corrected by noting that native GCE workload identity does not support third-party cloud identities.

Official Reference

https://cloud.google.com/iam/docs/workload-identity-federation

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a question specifies short-lived credentials and multi-cloud or hybrid environments, immediately prioritize Workload Identity Federation over service account keys. Always match the credential lifecycle requirement to the authentication mechanism before evaluating network or compute configurations.

Frequently Asked Questions

Why is a scoped access policy wrong here?

Scoped access policies restrict which resources can be accessed but do not generate the required short-lived tokens for external clouds.

Can Workload Identity Federation replace service account keys entirely?

Yes, WIF dynamically exchanges external tokens for Google OAuth tokens, eliminating the need to download or rotate static keys.

More PCSE FAQ →

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. ABotha 👍 4
    Correct Answer: C Short-lived access credentials: Workload Identity Federation (WIF) allows you to issue short-lived access tokens to external applications, reducing the risk of credential theft and misuse. Multiple clouds: You can create a workload identity pool for each external cloud, allowing applications from different environments to access your Google Cloud resources securely. Centralized management: WIF provides a centralized way to manage access to your Google Cloud resources, simplifying administration and improving security. Impersonation: By setting up a service account and adding an IAM binding for impersonation, you can allow external applications to act as the service account, granting them the necessary permissions to access your Google Cloud resources.
  2. BPzen 👍 1 Answered C
    For applications running in multiple clouds that need access to Google Cloud resources, the Workload Identity Federation feature is the most secure and scalable solution. It allows you to grant external workloads access to Google Cloud resources using short-lived credentials, eliminating the need to manage long-lived service account keys. Workload Identity Pool: Create a pool to represent identities from external clouds. Workload Identity Provider: Set up a provider for each external cloud to validate identities from those environments. Short-Lived Credentials: Use Google’s Security Token Service (STS) to exchange tokens from external identity providers for short-lived Google Cloud credentials. Service Account Impersonation: Set up a Google Cloud service account with the required permissions. Add an IAM binding to allow the external identity to impersonate the service account.
  3. Pime13 👍 1 Answered C
    Why Option C: Short-Lived Credentials: Workload Identity Federation allows you to use short-lived credentials, which are more secure than long-lived service account keys. Cross-Cloud Compatibility: By creating a workload identity pool and providers for each external cloud, you can securely authenticate and authorize applications running in different cloud environments. IAM Binding for Impersonation: This setup allows you to grant specific permissions to the service account, ensuring that only authorized actions are performed.
  4. SQLbox 👍 2
    C is the correct answer
  5. koo_kai 👍 2 Answered C
    It"s C
Show 2 more comments
  1. 1e22522 👍 2 Answered C
    It's C
  2. yokoyan 👍 1 Answered A
    I think it's A.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How to Implement TLS Interception for On-Premise Traffic in GCP

S-grade

How to Secure Vertex AI Training Jobs with Regional CMEK?

S-grade

How to Alert on Suspicious Outbound Traffic Using Threat Intelligence?

S-grade

How to Securely Host Databases Without Direct Internet Access?

S-grade

← Back to PCSE Study Guide