Objective 4.2

PCD

Consuming Google Cloud APIs

Objective 4.2 sits in Integrating applications with Google Cloud services, which carries 21% of the Cloud Developer exam. The questions below are original, written from the official objective title above, and each explanation cites the Google Cloud page it rests on.

Objective title verbatim from the official objectives. Google Cloud exam page

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

4-2Integrating applications with Google Cloud services

A team runs containers in a managed Kubernetes cluster and needs them calling Google Cloud APIs under a service account. Which method is indicated?

A downloaded key file mounted as a secretA file on disk is the credential this arrangement exists to avoid.
Workload identity federation for the clusterCorrect · your answerCorrect. The binding reaches the pod itself.
A service account attached to each nodeNode level identity is shared by everything scheduled there.
User credentials cached inside the imageAn end user identity in an image cannot be rotated or revoked cleanly.

Correct.

Concept

Binding a workload identity to a platform-issued token rather than to a stored file removes the one credential that can be copied out and used anywhere.

Why B

For containers in a managed Kubernetes cluster the guidance is federation, which attaches service accounts to pods instead of handing each one a static credential.

Source

Are you running containers in Google Kubernetes Engine? If yes, use Workload Identity Federation for GKE to attach service accounts to Kubernetes pods. If no, attach a service account to the resource.

Authentication for Google Cloud APIs and services, checked August 2026
#gcp#authentication#workload-identity#gke

Now you: objective 4.2 questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

4-2Integrating applications with Google Cloud services

A team runs a workload on another cloud provider whose identity provider supports workload identity federation. Where does the decision path lead?

Sample question 2 of 3

4-2Integrating applications with Google Cloud services

A team's developer works on a workstation and needs the identity the application will carry in production, not a personal one. What does the path give?

Sample question 3 of 3

4-2Integrating applications with Google Cloud services

A team wants one build of its code to authenticate correctly on a laptop and on a managed runtime with nothing changed between them. What makes that work?

Full Cloud Developer question bank coming

We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in Integrating applications with Google Cloud services