GCP Associate Cloud Engineer Practice Question 50: Dedicated VM Service Account
Google Cloud Associate Cloud Engineer · Test 5 · question 10 of 10
A VM runs a service that only publishes messages to one Pub/Sub topic. It currently runs as the default Compute Engine service account, which holds the Editor role on the project. A security review flags this as excessive.
What should you do?
Show answer and explanation
Answer:
The recommended practice is a dedicated, user-managed service account per workload that has only the roles it needs, here Pub/Sub Publisher on the one topic. Attach it to the VM (the VM must be stopped to change its service account), and applications use it through the metadata server with automatically rotated credentials.
Option B is not a good fix because the account still has Editor and access scopes are a legacy control that should not be the only guard. Option C creates a long-lived key that must be protected and rotated, when the metadata server already provides credentials. Option D would break every other workload that relies on the default service account and does not give this VM the specific access it needs.