Practise vocabulary for machine-to-machine authentication: API keys, service accounts, workload identity, and secret management.
0 / 15 completed
1 / 15
The practice of periodically replacing API keys or secrets to limit the window of exposure is called key ___.
Key rotation is the practice of replacing credentials on a schedule or after a potential exposure. Automated rotation (e.g., AWS Secrets Manager, HashiCorp Vault) reduces risk from long-lived credentials.
2 / 15
A ___ is a non-human identity used by an application or service to authenticate with other services.
A service account is an identity for applications and workloads, not humans. In Kubernetes, service accounts are used to grant pods access to APIs and secrets.
3 / 15
___ authentication uses client certificates on both sides to mutually verify identity between services.
Mutual TLS (mTLS) requires both the client and server to present certificates, providing strong mutual authentication — used in service mesh environments for zero-trust service-to-service communication.
4 / 15
___ identity avoids storing long-lived credentials by using the underlying cloud platform to automatically authenticate workloads.
Workload identity (e.g., GKE Workload Identity, AWS IRSA) lets pods assume IAM roles without storing credentials in environment variables or secrets — the platform handles authentication transparently.
5 / 15
A Key Management Service (KMS) is used for ___ encryption, where the KMS key encrypts a data key, which then encrypts the actual data.
Envelope encryption uses the KMS to encrypt a data key, not the data directly. The encrypted data key is stored alongside the encrypted data — only those with KMS access can decrypt the data key to decrypt the data.
6 / 15
Alex from the Security team just commented on your PR: 'I'm seeing a high number of failed authentication attempts originating from your service. Double-check that you're using the correct API key and that it hasn't been revoked.' Which of the following best describes what Alex is likely referring to?
Alex is concerned about unauthorized access. An incorrect or revoked API key allows malicious actors to impersonate your service and potentially gain control. It's crucial to regularly monitor for authentication failures which are a strong indicator of this issue. Options A, B, and C represent different system-level problems but don't directly address the core vulnerability of an invalid API key.
7 / 15
During a daily standup, Ben asks, 'Has anyone updated their service account credentials for the new microservice deployment?' You respond: 'Yes, we've transitioned to using a dedicated service account with restricted permissions for accessing the database. This account is managed through our Key Management Service.' What does this response primarily communicate?
Ben's question highlights the importance of secure credential management. Your response emphasizes the use of a Key Management Service (KMS) to provide a centralized and controlled way to manage service account credentials—a best practice for security and compliance. Options A, B, and C represent related but distinct concepts; the core message here is about centralized credential management.
8 / 15
You're debugging an API call that consistently fails with a '403 Forbidden' error. The server logs show the request was authenticated using a service account. Examining the service account's configuration reveals it has overly broad permissions—it can access resources it doesn't actually need. What is the most likely root cause of this issue?
A '403 Forbidden' error indicates an authorization problem. Overly broad permissions granted to the service account allow it to access resources it shouldn't, triggering this error. Proper IAM role management ensures that each service account has only the minimum necessary privileges – a fundamental security principle. Options A and C are potential issues but don't directly explain the 403 error in this specific scenario.
9 / 15
Chloe, a senior developer, asks you to describe your team's approach to managing API keys. You explain that you use 'workload identity' to authenticate your application with Google Cloud services. What does 'workload identity' primarily achieve?
'Workload identity' is a key security feature that leverages the trust relationships already established between your cloud provider and your workloads. It avoids storing long-lived API keys by using the underlying cloud platform to automatically authenticate your applications – reducing the attack surface. Option A describes user credentials; B is incorrect as it doesn't explain the core principle of workload identity.
10 / 15
You're designing a system that uses KMS to encrypt sensitive data. Which statement BEST describes KMS's role in this scenario?
KMS (Key Management Service) is responsible for securely managing the lifecycle of encryption keys. This includes generating new keys, rotating them regularly to reduce risk, and controlling who has access to them. While KMS provides auditing logs (option D), its primary function is key management itself. Options A and C are incorrect as they describe a simplified view of how KMS operates.
11 / 15
Alex from the Security team just commented on your PR: 'I'm seeing a high number of failed authentication attempts originating from your service. Double-check that you're using the correct API key and that it hasn't been revoked.' Which of the following best describes what Alex is likely referring to?
Alex is concerned about unauthorized access. An incorrect or revoked API key allows malicious actors to impersonate your service and potentially gain control. It's crucial to regularly monitor for authentication failures which are a strong indicator of this issue. Options A, B, and C represent different system-level problems but don't directly address the core vulnerability of an invalid API key.
12 / 15
During a daily standup, Ben asks, 'Has anyone updated their service account credentials for the new microservice deployment?' You respond: 'Yes, we've transitioned to using a dedicated service account with restricted permissions for accessing the database. This account is managed through our Key Management Service.' What does this response primarily communicate?
Ben's question highlights the importance of secure credential management. Your response emphasizes the use of a Key Management Service (KMS) to provide a centralized and controlled way to manage service account credentials—a best practice for security and compliance. Options A, B, and C represent related but distinct concepts; the core message here is about centralized credential management.
13 / 15
You're debugging an API call that consistently fails with a '403 Forbidden' error. The server logs show the request was authenticated using a service account. Examining the service account's configuration reveals it has overly broad permissions—it can access resources it doesn't actually need. What is the most likely root cause of this issue?
A '403 Forbidden' error indicates an authorization problem. Overly broad permissions granted to the service account allow it to access resources it shouldn't, triggering this error. Proper IAM role management ensures that each service account has only the minimum necessary privileges – a fundamental security principle. Options A and C are potential issues but don't directly explain the 403 error in this specific scenario.
14 / 15
Chloe, a senior developer, asks you to describe your team's approach to managing API keys. You explain that you use 'workload identity' to authenticate your application with Google Cloud services. What does 'workload identity' primarily achieve?
'Workload identity' is a key security feature that leverages the trust relationships already established between your cloud provider and your workloads. It avoids storing long-lived API keys by using the underlying cloud platform to automatically authenticate your applications – reducing the attack surface. Option A describes user credentials; B is incorrect as it doesn't explain the core principle of workload identity.
15 / 15
You're designing a system that uses KMS to encrypt sensitive data. Which statement BEST describes KMS's role in this scenario?
KMS (Key Management Service) is responsible for securely managing the lifecycle of encryption keys. This includes generating new keys, rotating them regularly to reduce risk, and controlling who has access to them. While KMS provides auditing logs (option D), its primary function is key management itself. Options A and C are incorrect as they describe a simplified view of how KMS operates.
What will I practise in "API Keys & Service Account Language"?
Practise vocabulary for machine-to-machine authentication: API keys, service accounts, workload identity, and secret management.
How many exercises are in this module?
This module has 15 multiple-choice exercises, each with instant feedback and a full explanation of the correct answer.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall.
Do I need to create an account to do these exercises?
No account is required. Just click an option to answer — your score for this session is tracked automatically in the progress bar above.
What happens if I choose the wrong answer?
You'll immediately see which answer was correct, plus a full explanation covering the vocabulary and reasoning behind it — mistakes are where most of the learning happens.
Can I retry the exercises if I want a higher score?
Yes — use the "Try again" button on the results screen to reset and go through all the questions again.
Is my progress saved if I close the page?
No. Progress is tracked only for your current visit; reloading or leaving the page resets the counter. This keeps the exercise simple and account-free.
Where can I find more Identity & Access Management exercises?
Browse the full Identity & Access Management hub for related drills, or check the "Next up" link below to continue with a connected topic.
How is this different from reading an article on the same topic?
Articles explain vocabulary and concepts in prose; this exercise tests and reinforces that vocabulary through active recall with immediate feedback — the two work best together.
Who writes these exercises?
Every exercise is written by the CoderSlingo team, drawing on real workplace English used in IT roles, then reviewed for accuracy and clarity.