Google ACE Setting Up a Cloud Solution Environment Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  roles/compute.instanceAdmin.v1

  Why it's wrong here

  This prebuilt role grants full administrative control over Compute Engine instances—including starting and stopping VMs, creating and deleting instances, modifying machine types, and attaching persistent disks. It is explicitly an admin role, not a read-only role, so it violates the requirement of least privilege by allowing a contractor to make destructive or costly changes. Even though it is scoped to Compute Engine, its management actions go far beyond the read access requested.

• ✗

  roles/viewer

  Why it's wrong here

  The basic viewer role grants read-only permissions for every supported service in the project, such as Cloud Storage, BigQuery, Cloud SQL, and the Cloud Console, not just Compute Engine. Granting it to a contractor would expose the entire project's metadata and resource configurations to their view, which is significantly broader than the stated need for compute resource read access. IAM best practice says to choose the narrowest role that covers the required permissions; therefore viewer is overly permissive.

• ✓

  roles/compute.viewer

  Why this is correct

  This predefined role contains only read permissions for Compute Engine resources, including instances, disks, images, snapshots, instance templates, and usage metrics, and it allows you to see them in the Cloud Console without any write or administrative actions. It precisely matches the contractor's access need and nothing more, upholding the principle of least privilege. As the correct answer, it is the best fit for granting read-only access to Compute Engine resources only.

• ✗

  roles/iam.securityReviewer

  Why it's wrong here

  This role is designed for auditors and security reviewers; it grants permission to list IAM policies and view audit logs to identify security issues, not to read Compute Engine instance configurations or inventory. It would not satisfy the user's requirement for read access to compute resources, and in fact would let the contractor inspect IAM policy bindings, which is a broader security permission that should be granted cautiously. Therefore it is the wrong choice for this scenario.

Go deeper

Related to this question