easyMultiple ChoiceObjective-mapped
Google ACE Practice Question: A security auditor needs read-only access to…
A security auditor needs read-only access to Compute Engine instance metadata but should not be able to start or stop instances. Which predefined IAM role should be assigned?
⚠ Common exam trap
Many exam-takers confuse 'viewer' with broader roles like instanceAdmin.v1, assuming read-only access is sufficient, but fail to recognize that instanceAdmin.v1 includes write permissions for starting/stopping instances.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
roles/compute.viewer
The roles/compute.viewer role grants read-only access to Compute Engine resources, including instance metadata, without allowing write operations such as starting or stopping instances. This matches the requirement for read-only metadata access while preventing instance lifecycle changes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
roles/compute.instanceAdmin.v1
Why it's wrong here
roles/compute.instanceAdmin.v1 grants full control over Compute Engine instances, including start, stop, restart, delete, and modification of instance metadata, tags, and attached disks. Although it includes read-only permissions, it goes far beyond an auditor's need by allowing destructive and mutating actions. This role violates the principle of least privilege because an auditor could inadvertently change instance configuration while reviewing resources.
- ✗
roles/compute.admin
Why it's wrong here
roles/compute.admin is the most permissive Compute Engine role, providing complete administrative control over all compute resources, such as creating and deleting instances, modifying firewall rules, and managing persistent disks. It also allows changing IAM policies on compute resources, effectively granting the ability to reconfigure the entire project's compute infrastructure. This level of access is excessive for a security auditor who only needs to inspect resources without making any changes.
- ✗
roles/compute.networkAdmin
Why it's wrong here
roles/compute.networkAdmin is scoped to the management of networking resources like VPC networks, firewall rules, and routes, and it does not grant access to instance-level metadata or most instance configuration details. While it includes some read permissions for networks, it also allows write actions such as creating or deleting firewall rules and routes, making it non-read-only. Since the auditor requires broad visibility into instances, this role is both insufficient for inspecting instances and too permissive for network management.
- ✓
roles/compute.viewer
Why this is correct
roles/compute.viewer is the correct predefined IAM role for a read-only security auditor because it grants only list and get permissions for all Compute Engine resources, including instances, disks, snapshots, images, and instance metadata. It does not include any mutating operations such as start, stop, delete, or modify, nor does it allow changes to IAM policy. This role satisfies the auditor's requirement to inspect the environment without risking unintended changes.
Go deeper
Related to this question
Learn chapter
Google Compute Engine
Key term
IAM role
An IAM role is a set of permissions that an entity can assume temporarily to access cloud resources securely.
Key term
Compute Engine
Compute Engine is Google Cloud's Infrastructure-as-a-Service (IaaS) offering that lets you create and run virtual machines on Google's infrastructure.
About these practice questions
One of 769 original ACE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.