Google Professional Cloud DevOps Engineer Exam - Topic 2 Question 100 Discussion

Actual exam question for Google's Professional Cloud DevOps Engineer exam

Question #: 100
Topic #: 2

[All Professional Cloud DevOps Engineer Questions]

[Building and implementing service monitoring strategies]

A third-party application needs to have a service account key to work properly When you try to export the key from your cloud project you receive an error "The organization policy constraint larn.disableServiceAccountKeyCreation is enforcedM You need to make the third-party application work while following Google-recommended security practices What should you do?

AEnable the default service account key. and download the key

BRemove the iam.disableServiceAccountKeyCreation policy at the organization level, and create a key.

CDisable the service account key creation policy at the project's folder, and download the default key

DAdd a rule to set the iam.disableServiceAccountKeyCreation policy to off in your project and create a key.

Show Suggested Answer

Suggested Answer: D

by Felix at Jan 05, 2026, 05:16 AM

Limited Time Offer

25%

Off

Get Premium Professional Cloud DevOps Engineer Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Sheridan

3 days ago

Hmm, I'm not sure about this one. Disabling the policy at the project level in C) seems like it could work too.

upvoted 0 times

...

Luther

8 days ago

D) sounds like a good option, but it's better to remove the policy at the organization level as suggested in B).

upvoted 0 times

...

Vicki

13 days ago

B) is the correct answer. Removing the policy at the organization level is the way to go.

upvoted 0 times

...

Dortha

18 days ago

I recall that removing organization policies can lead to compliance issues. I wonder if option C is the safest bet here.

upvoted 0 times

...

Paola

23 days ago

I’m not entirely sure, but I think enabling the default service account key isn’t a good idea. It could expose us to security issues.

upvoted 0 times

...

Lauryn

28 days ago

This question feels familiar! I think I practiced something similar where we had to manage service account permissions. I’m leaning towards option D.

upvoted 0 times

...

Tish

1 month ago

I remember studying about service account keys and the importance of not disabling security policies. I think option B might be risky.

upvoted 0 times

...

Evette

1 month ago

Hmm, I'm not sure about disabling the policy at the project level. That might not be the best approach from a security standpoint. I'll need to think this through carefully.

upvoted 0 times

...

Magdalene

1 month ago

This seems straightforward to me. The policy is set at the organization level, so we'll need to remove it there in order to create the key. Option B looks like the right choice.

upvoted 0 times

...

Edward

2 months ago

I'm a bit confused by the wording of the question. Is the goal to enable the default service account key, or to create a new one? I'll need to double-check the details before selecting an answer.

upvoted 0 times

...

Tien

2 months ago

Okay, I think I understand the issue. The organization has a policy in place that's preventing us from creating a service account key. We'll need to find a way to work around that while still following best practices.

upvoted 0 times

...

Eric

2 months ago

Hmm, this looks like a tricky one. I'll need to carefully read through the options and think about the security implications of each approach.

upvoted 0 times

...