Which statement best describes how to handle service accounts in practice?

• A. Groupings for resource access simplify onboarding.
• B. Assigning permissions individually per resource.
• C. Using only roles with no group concept.
• D. Grouping users for resource access to simplify onboarding.

Answer: (C)

Handle service accounts as machine identities and grant them access through roles, not groups. This keeps permissions scalable and auditable: bind each service account to the minimal set of roles that cover what the service needs. Grouping service accounts isn’t typically helpful and can complicate rotation and tracing, while assigning permissions one by one per resource is error-prone and hard to manage. So using roles without a group concept best fits how service accounts are used in practice.