Google ACE Configuring Access and Security Practice Question
A DevOps team needs to grant a CI/CD service account the ability to create secrets in Secret Manager. Which role should be assigned?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
roles/secretmanager.admin
The roles/secretmanager.admin role grants full control, including creating secrets. roles/secretmanager.secretCreator does not exist; the admin role includes create permission.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
roles/secretmanager.admin
Why this is correct
The `roles/secretmanager.admin` role includes the `secretmanager.secrets.create` permission required for adding a new secret via the Cloud Console, gcloud CLI, or Secret Manager API. It also grants full management of versions, IAM policies, and deletion, so it is the predefined role that reliably supports all CI/CD operations that need to provision and rotate secrets.
- ✗
roles/secretmanager.secretCreator
Why it's wrong here
No predefined IAM role named `roles/secretmanager.secretCreator` exists in Cloud IAM. Attempting to bind the service account to this invented role will cause the IAM policy update to be rejected, so it cannot grant the necessary `secretmanager.secrets.create` permission. The correct predefined role for creating secrets remains `roles/secretmanager.admin`, which is overly broad but the only built-in option.
- ✗
roles/secretmanager.secretAccessor
Why it's wrong here
`roles/secretmanager.secretAccessor` grants narrowly scoped permissions such as `secretmanager.versions.access`, allowing the service account only to read secret payloads from already-created secret versions. It does not include `secretmanager.secrets.create` or any write permission, so it cannot create or update secrets and is therefore insufficient for a CI/CD pipeline that must initially provision a secret.
- ✗
roles/secretmanager.viewer
Why it's wrong here
`roles/secretmanager.viewer` provides read-only metadata access, including `secretmanager.secrets.get` and `secretmanager.secrets.list`, but it lacks `secretmanager.secrets.create` and even `secretmanager.versions.access`. This role is only suitable for inventory or discovery tasks where engineers need to see that secrets exist, not for a DevOps pipeline that must create or consume the secret payload.
Go deeper
Related to this question
Learn chapter
Deployment Manager and Terraform on GCP
Key term
Secret Manager
A Secret Manager is a centralized tool that securely stores, manages, and controls access to sensitive information like passwords, API keys, and certificates, often automating their rotation and injection into applications.
Key term
Service account
A service account is a special type of account used by an application or a virtual machine, rather than a human user, to authenticate and interact with cloud services and APIs securely.
About these practice questions
One of 769 original ACE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.