Objective 4.2
ACEManaging service accounts
Objective 4.2 sits in Configuring access and security, which carries 20% of the Associate Cloud Engineer exam. The questions below are original, written from the official objective title above, and each explanation cites the Google Cloud page it rests on.
Objective title verbatim from the official objectives. Google Cloud exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
An engineer finds a VM running as an identity ending in -compute@developer.gserviceaccount.com. Which default service account is that?
Correct.
Concept
Default identities are named after the service that created them, so the address itself tells you what enabled it and which project it belongs to without any lookup.
Why B
The Compute Engine default service account uses the address project-number-compute@developer.gserviceaccount.com and is created when Compute Engine is enabled.
Now you: objective 4.2 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
A team finds an identity addressed as project-id@appspot.gserviceaccount.com in their allow policy. Which service created it?
Sample question 2 of 3
A team discovers their default service account already holds the Editor role on the project. What does Google recommend they do?
Sample question 3 of 3
An organization created in 2025 finds its default service accounts never receive the Editor role. From which date is that constraint enforced by default?
Full Associate Cloud Engineer question bank coming
We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.
Read the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.