easyMultiple ChoiceObjective-mapped
Google ACE Practice Question: A startup wants to grant developers the ability…
A startup wants to grant developers the ability to create and manage Compute Engine instances, but prevent them from deleting instances or changing firewall rules. Which IAM approach should they use?
⚠ Common exam trap
Google Cloud often tests the distinction between predefined roles that sound similar (like instanceAdmin.v1 vs. a non-existent instanceOperator) and the need for custom roles when predefined roles do not match the exact permission set required.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a custom role with permissions for instance management but without compute.instances.delete.
Creating a custom role allows the startup to grant fine-grained permissions for instance management (e.g., compute.instances.create, compute.instances.start, compute.instances.stop) while explicitly omitting compute.instances.delete and any firewall-related permissions like compute.firewalls.update or compute.firewalls.delete. This ensures developers can manage instances but cannot delete them or alter firewall rules, meeting the exact requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a custom role with permissions for instance management but without compute.instances.delete.
Why this is correct
A custom role lets you assemble an exact allowlist of permissions, such as compute.instances.create, start, and stop, while deliberately omitting compute.instances.delete. This satisfies the developer requirement to create and manage instances without granting the destructive capability to terminate them, enforcing least privilege. Because permissions map directly to specific API methods, you can precisely exclude deletion without losing any other management functionality.
- ✗
Assign the roles/compute.instanceAdmin.v1 role.
Why it's wrong here
roles/compute.instanceAdmin.v1 is a predefined role that provides a broad set of Compute Engine permissions, notably including compute.instances.delete. Assigning this role would allow developers to delete instances, which directly violates the requirement that they should not have that capability. Additionally, this role includes permissions to modify instance metadata and set tags, making it overly permissive for a scoped developer task.
- ✗
Assign the roles/compute.instanceOperator role.
Why it's wrong here
roles/compute.instanceOperator is designed for operating existing instances—starting, stopping, resetting, and viewing them—but critically, it does not include compute.instances.create. Since the startup specifically requires developers to create new instances, this role fails the core need. Without permission to create instances, developers are locked into managing only instances that already exist, so it is not a viable substitute for a custom role.
- ✗
Assign the roles/compute.admin role.
Why it's wrong here
roles/compute.admin is the most privileged Compute Engine role, granting full control over instances, disks, snapshots, networks, and firewalls, including compute.instances.delete and the ability to modify global infrastructure. Assigning this role to developers would not only allow instance deletion but also permit changes to networking and other project-wide settings, going far beyond the stated requirement and creating a serious security risk.
Go deeper
Related to this question
Learn chapter
Google Compute Engine
Key term
Custom role
A custom role is a user-defined set of permissions in Google Cloud that you can tailor to fit specific job functions beyond the predefined roles.
Key term
IAM
Identity and Access Management (IAM) is a framework of policies and technologies that ensures the right individuals have the appropriate access to technology resources.
About these practice questions
Courseiva writes every ACE question from scratch — 769 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.