Google ACE Configuring Access and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  gcloud projects add-iam-policy-binding

  Why this is correct

  gcloud projects add-iam-policy-binding is the precise command to grant an existing service account an IAM role on a project. It performs an additive update to the project's IAM policy, leaving all other bindings intact, which is exactly what is needed when automating service account creation and subsequent access provisioning. The command requires the service account's email as the member and the role name (e.g., roles/storage.objectViewer), and it applies the binding only at the project level, matching the scenario.

• ✗

  gcloud iam service-accounts keys create

  Why it's wrong here

  gcloud iam service-accounts keys create is used to generate and download a JSON or P12 key file for a service account. This is not required in the scenario because authenticating as the service account with a key is separate from granting it permissions; the developer's goal is to automate creation and authorization, not to set up key-based authentication. Moreover, creating a key expands the attack surface and should be avoided unless the workload explicitly needs service-to-service authentication outside Google Cloud.

• ✗

  gcloud projects set-iam-policy

  Why it's wrong here

  gcloud projects set-iam-policy replaces the entire IAM policy for a project with the policy provided in a file or via standard input. Using it to add a single binding is risky and discouraged because you must first fetch the full policy, modify it, and then write it back; any concurrent change by another process would be lost, causing a denial of access. In contrast, add-iam-policy-binding performs a read-modify-write under the hood with optimistic concurrency control, making it the safe, targeted choice for this automation.

• ✓

  gcloud iam service-accounts create

  Why this is correct

  gcloud iam service-accounts create is the command that creates a new service account identity in a project, and it is a necessary first step in the automation workflow. However, creating the identity alone does not grant any permissions; the service account will have no access to project resources until a role is bound to it. Therefore, this command is correct as a component of the solution but is not the single answer to the developer's goal—the binding step is the essential final action.

• ✗

  gcloud iam roles create

  Why it's wrong here

  gcloud iam roles create is used to define a custom IAM role in a project or organization. The scenario does not mention any need for a custom role; the developer can grant a predefined role (such as roles/compute.admin or roles/storage.objectAdmin) to the service account using add-iam-policy-binding. Invoking this command would create an unnecessary role resource and does not itself assign any permissions to the service account, so it is unrelated to the requested automation.

Go deeper

Related to this question