On-Premises Applications Accessing Google Cloud Without Hardcoded Credentials?

PCSE By islever Editorial Last updated

Short answer

D Configure Workload Identity Federation to map on-premises identity tokens to short-lived Google Cloud credentials for application access.

Question

Your organization has a centralized identity provider that is used to manage human and machine access. You want to leverage this existing identity management system to enable on-premises applications to access Google Cloud without hard coded credentials. What should you do?
  1. Enable Secure Web Proxy. Create a proxy subnet for each region that Secure Web Proxy will be deployed. Deploy an SSL certificate to Certificate Manager. Create a Secure Web Proxy policy and rules that allow access to Google Cloud services.
  2. Enable Workforce Identity Federation. Create a workforce identity pool and specify the on-premises identity provider as a workforce identity pool provider. Create an attribute mapping to map the on-premises identity provider token to a Google STS token. Create an IAM binding that binds the required role(s) to the external identity by specifying the project ID, workload identity pool, and attribute that should be matched.
  3. Enable Identity-Aware Proxy (IAP). Configure IAP by specifying the groups and service accounts that should have access to the application. Grant these identities the IAP-secured web app user role.
  4. Enable Workload Identity Federation. Create a workload identity pool and specify the on-premises identity provider as a workload identity pool provider. Create an attribute mapping to map the on-premises identity provider token to a Google STS token. Create a service account with the necessary permissions for the workload. Grant the external identity the Workload Identity user role on the service account. Correct Answer

Key Takeaways

The exam tests your ability to distinguish between human and machine identity federation, with the common trap being misreading applications as requiring workforce solutions.

This question tests the distinction between Workload and Workforce Identity Federation for secure cloud access. Community consensus confirms Workload Identity Federation is correct for non-human application access.

Common mistake: Option B is frequently chosen because test-takers overlook the word applications and incorrectly assume any centralized identity provider integration requires Workforce Identity Federation.

Expert Analysis

Why the Answer Is Correct

Workload Identity Federation enables non-human entities like on-premises applications to exchange external tokens for short-lived Google Cloud credentials. By configuring a workload identity pool and mapping attributes from your centralized identity provider, applications can securely access Google Cloud services without managing long-term API keys or service account keys. This aligns directly with Google Cloud zero-trust architecture and eliminates hardcoded credentials entirely. As noted in the discussion, this feature is specifically designed for automated workloads rather than human users.

Why the Other Options Are Wrong

Option B configures Workforce Identity Federation, which is strictly intended for human employees accessing Google Cloud via corporate SSO, not automated applications. Option A deploys Secure Web Proxy, which controls outbound web traffic but does not solve the underlying credential management problem for direct API access. Option C implements Identity-Aware Proxy, which provides application-level firewall protection and access control but does not handle external identity federation or replace hardcoded backend credentials. Each alternative addresses network security or human access patterns instead of machine identity federation.

Community Comment Notes

Multiple high-voted comments emphasize the keyword applications as the deciding factor between Workload and Workforce Identity Federation. Contributors correctly point out that Workload Identity Federation handles machines while Workforce handles people, leading to a strong consensus around Option D. One dissenting comment mistakenly focused only on the word identity without considering the workload context, which was quickly outweighed by technical explanations. The voting distribution clearly reflects this shared understanding of Google Cloud IAM best practices.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Always scan for the actor type when evaluating Identity Federation options in PCSE exams. Map humans, employees, or SSO to Workforce Identity Federation, and scripts, workloads, or on-premises apps to Workload Identity Federation to avoid costly reading comprehension traps.

Frequently Asked Questions

Why isn't Workforce Identity Federation suitable for on-premises applications?

Workforce Identity Federation is designed exclusively for human users logging into Google Cloud consoles or APIs. Applications require Workload Identity Federation to exchange machine tokens for temporary service account credentials.

Can Workload Identity Federation replace all hardcoded service account keys?

Yes, it allows workloads to request short-lived OAuth2 tokens instead of storing static JSON key files. This significantly reduces the attack surface and eliminates manual key rotation overhead.

More PCSE FAQ →

Community Votes

D
83%
B
17%

83% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. Art 👍 4 Answered D
    It's D "You want to leverage this existing identity management system to enable on-premises applications to access Google Cloud without hard coded credentials" Workload Identity Federation is used for applications when Workforce Identity Federation is used for humans
  2. d0fa7d5 👍 4 Answered D
    “Since it mentions ‘on-premises applications,’ I believe the correct answer is D, not B.”
  3. nah99 👍 1 Answered D
    The requirement of the question is for applications, not persons. So D.
  4. eychdee 👍 1
    its B. keyword is workforce and not workload
  5. yokoyan 👍 2 Answered B
    I think it's B.
Show 1 more comment
  1. 1e22522 👍 1 Answered D
    Im pretty sure its D

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How to Implement TLS Interception for On-Premise Traffic in GCP

S-grade

How to Secure Vertex AI Training Jobs with Regional CMEK?

S-grade

How to Alert on Suspicious Outbound Traffic Using Threat Intelligence?

S-grade

How to Securely Host Databases Without Direct Internet Access?

S-grade

← Back to PCSE Study Guide