Secure application platform access to Google Cloud following Google best practices. What do you implement?
Choose an answer
Tap an option to check your answer.
Correct answer: Use Workload Identity and service accounts for the application platform..
Why this is the answer
Workload Identity allows a Kubernetes service account to act as a Google Cloud service account, granting fine-grained permissions to applications running on GKE. This is Google's recommended best practice for secure access from applications to Google Cloud services, eliminating the need to store and manage service account keys directly. Storing secrets in Kubernetes Secrets, even with Application-Layer Secrets Encryption, still involves managing secrets within the cluster, which is less secure than Workload Identity for direct GCP access. Deploying HashiCorp Vault is a valid solution for secrets management but adds operational overhead and is not the primary Google-native best practice for application platform access to GCP services.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed