hardMultiple ChoiceObjective-mapped
Google ACE Practice Question: A service account needs to be able to create…
A service account needs to be able to create snapshots of disks in a specific project and store them in a different project. What is the correct IAM policy configuration?
⚠ Common exam trap
Google Cloud often tests the misconception that a single role like `compute.storageAdmin` or `compute.instanceAdmin` can handle cross-project snapshot operations, when in fact you need a combination of snapshot-specific and bucket-specific roles.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Grant roles/compute.snapshotAdmin on the source project and roles/storage.objectAdmin on the target bucket
Creating snapshots in one project and storing them in another requires distinct permissions: `roles/compute.snapshotAdmin` on the source project allows the service account to create snapshots, while `roles/storage.objectAdmin` on the target bucket (within the destination project) grants the necessary permissions to write snapshot data into the bucket. This separation follows the principle of least privilege and aligns with the cross-project snapshot workflow.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Grant roles/compute.storageAdmin on both projects
Why it's wrong here
There is no predefined IAM role called roles/compute.storageAdmin in Compute Engine; the closest legacy role, if it existed, would not grant the ability to create disk snapshots. Snapshot creation requires roles/compute.snapshotAdmin on the source project, and writing the snapshot image to the target bucket requires roles/storage.objectAdmin. Assigning a nonexistent or misapplied role on both projects neither creates snapshots nor writes objects.
- ✗
Grant roles/viewer on both projects
Why it's wrong here
The viewer role (roles/viewer) is read-only and grants permissions to list and inspect resources, but it does not include any write actions such as creating a Compute Engine snapshot. Even if the principal can see the disks and the bucket, the operation will fail because IAM authorization is denied. To create a snapshot, you need compute.snapshots.create, which is only included in a role like compute.snapshotAdmin.
- ✓
Grant roles/compute.snapshotAdmin on the source project and roles/storage.objectAdmin on the target bucket
Why this is correct
This pairing correctly separates concerns: roles/compute.snapshotAdmin on the source project includes compute.snapshots.create and compute.disks.get permissions, allowing the service account to initiate a snapshot from the persistent disk. Meanwhile, roles/storage.objectAdmin on the target bucket permits the service account to write the snapshot image as an object into that Cloud Storage bucket. This is the standard pattern for cross-project snapshotting, because the snapshot is staged as an object in the designated bucket.
- ✗
Grant roles/compute.instanceAdmin on the source project and roles/storage.objectAdmin on the target bucket
Why it's wrong here
roles/compute.instanceAdmin on the source project grants the ability to start, stop, and modify VM instances, but it does not include the compute.snapshots.create permission needed to create disk snapshots. While roles/storage.objectAdmin on the target bucket correctly allows writing objects, the missing snapshotAdmin role means the service account cannot trigger the snapshot itself. This option is insufficient because IAM is additive and neither role covers snapshot creation.
Go deeper
Related to this question
Learn chapter
Google Compute Engine
Key term
Service account
A service account is a special type of account used by an application or a virtual machine, rather than a human user, to authenticate and interact with cloud services and APIs securely.
Key term
IAM policy
An IAM policy is a set of rules that determines who can access specific cloud resources and what actions they are allowed to perform.
About these practice questions
One of 769 original ACE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.