Objective 3.1
PCADesigning for security
Objective 3.1 sits in Designing for security and compliance, which carries 17.5% of the Cloud Architect exam. The questions below are original, written from the official objective title above, and each explanation cites the Google Cloud page it rests on.
Objective title verbatim from the official objectives. Google Cloud exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
An application running on AWS authenticates to Google Cloud APIs with a downloaded service account key, and the security team wants that key gone. Which approach removes it?
Correct.
Concept
A long-lived credential stays a liability wherever it is kept, so the durable fix is an identity the external platform already proves rather than a secret somebody has to hold.
Why C
Workload Identity Federation lets workloads outside Google Cloud use federated identities in place of a service account key, removing the maintenance and security burden those keys carry.
Source
Workload Identity Federation, IAM documentation, checked August 2026Applications running outside Google Cloud can use service account keys to access Google Cloud resources. However, service account keys are powerful credentials, and can present a security risk if they are not managed correctly. Workload Identity Federation eliminates the maintenance and security burden associated with service account keys.
Now you: objective 3.1 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
A team federates a public identity provider that many organizations use, and only credentials carrying one specific AWS role should be accepted. Which control enforces that?
Sample question 2 of 3
An engineer writes an IAM binding for a single federated identity and needs the attribute that names it uniquely. Which attribute does a principal binding use?
Sample question 3 of 3
A federated workload will act through an existing service account rather than holding resource roles of its own. Which role does that arrangement require?
Full Cloud Architect question bank coming
We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.
Read the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.