An identity that applications, VMs, and other workloads use to call Google Cloud APIs instead of a person’s credentials. It can be user-managed or a Google-managed service agent, and it is granted IAM roles like any principal.
The ACE asks about creating a dedicated account per application with least privilege, attaching it to a VM or Cloud Run (which requires the Service Account User role), and avoiding downloadable keys.
Service account (Google Cloud) is a concept that can show up on the exam. Check the full guide to see it in context.