Google ACE Configuring Access and Security Practice Question
A developer needs to store a database password in Secret Manager and then allow a Compute Engine instance to access it. The instance uses the default compute engine service account. Which role should be granted to the service account?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
roles/secretmanager.secretAccessor
To access the secret version's payload, the service account needs the 'secretmanager.secretAccessor' role on the secret (or project). That role allows accessing secret versions. roles/secretmanager.admin is too broad. roles/cloudsql.client is for Cloud SQL, not Secret Manager. roles/viewer does not allow access to secret payloads.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
roles/cloudsql.client
Why it's wrong here
roles/cloudsql.client is a Cloud SQL-specific role that grants permissions such as cloudsql.instances.connect and cloudsql.instances.get to allow IAM-authenticated connections to Cloud SQL databases. It does not include any secretmanager.* permissions, specifically missing secretmanager.versions.access. A developer with this role still cannot retrieve the database password from Secret Manager, as the role is scoped to Cloud SQL resources, not secret payloads.
- ✗
roles/secretmanager.admin
Why it's wrong here
roles/secretmanager.admin is an overprivileged role for this task, as it grants full administrative control over secrets, including creating, editing, deleting, and configuring IAM policies on secrets via permissions like secretmanager.secrets.create, secretmanager.secrets.delete, and secretmanager.secrets.setIamPolicy. A developer only needs to read the stored password, so granting admin violates the principle of least privilege and could allow accidental or malicious deletion of the secret, or changing its access controls. The admin role does include secretmanager.versions.access, but it is far more than necessary and introduces security risk.
- ✗
roles/viewer
Why it's wrong here
roles/viewer provides broad read-only permissions to many Google Cloud resources, but it deliberately excludes secretmanager.versions.access, the specific permission needed to retrieve the actual secret payload. A viewer can list secrets and view their metadata (e.g., name, labels, creation time) using permissions like secretmanager.secrets.get, but when trying to access the secret value, access is denied. This design means that having viewer access does not grant the ability to read sensitive data stored in Secret Manager.
- ✓
roles/secretmanager.secretAccessor
Why this is correct
roles/secretmanager.secretAccessor is the correct predefined role for accessing a secret payload because it includes the secretmanager.versions.access permission, which is the exact IAM permission required to retrieve the stored database password. This role is narrowly scoped; it grants no management capabilities like secret creation, deletion, or IAM policy changes. For a developer whose sole need is to fetch the secret value at runtime, this role provides the minimum access needed while supporting least privilege best practices.
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
Cloud SQL
Cloud SQL is a fully managed relational database service that lets you set up, maintain, and scale SQL databases (like MySQL, PostgreSQL, and SQL Server) in the cloud without managing the underlying infrastructure.
Key term
Secret Manager
A Secret Manager is a centralized tool that securely stores, manages, and controls access to sensitive information like passwords, API keys, and certificates, often automating their rotation and injection into applications.
About these practice questions
This ACE question is part of Courseiva's 769-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.