A mechanism by which a principal gets short-lived credentials for a service account, without keys, to act with its permissions. It requires the Service Account Token Creator role on the account; in gcloud you use --impersonate-service-account.
On the ACE it is the recommended alternative to downloading keys: an administrator runs commands with a service account’s permissions, and everything is recorded in the audit logs with both identities.
Service account impersonation is a concept that can show up on the exam. Check the full guide to see it in context.