Google ACE Configuring Access and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  gcloud iam service-accounts create and gcloud iam service-accounts add-iam-policy-binding

  Why it's wrong here

  This command pair is incorrect because `gcloud iam service-accounts add-iam-policy-binding` modifies the IAM policy of the service account resource itself, not the project. That binding would grant principals permissions to use or administer the service account (e.g., roles/iam.serviceAccountUser), but it does not grant the service account any roles on the project. To grant the new service account a role on the project, you must add the service account as a member in the project's IAM policy using `gcloud projects add-iam-policy-binding`.

• ✗

  gcloud projects add-iam-policy-binding only

  Why it's wrong here

  Running only `gcloud projects add-iam-policy-binding` fails for this scenario because the service account does not yet exist. The command expects the member identifier (the service account email) to already be present in the project, and creating a binding to a non-existent principal will either error out or have no effect. Since the requirement explicitly says to create a new service account, a `gcloud iam service-accounts create` step is mandatory before any project-level binding can be applied.

• ✓

  gcloud iam service-accounts create and gcloud projects add-iam-policy-binding

  Why this is correct

  This is the correct sequence: first, `gcloud iam service-accounts create` provisions the service account and generates its unique email address, which becomes the IAM member identity. Then, `gcloud projects add-iam-policy-binding` adds that service account email as a member in the project's IAM policy and grants the specified role (e.g., roles/storage.objectAdmin) for the whole project. This binds the service account as an identity to the project-level resource, which is exactly what is needed.

• ✗

  gcloud iam service-accounts create and gcloud iam roles create

  Why it's wrong here

  The flaw in this pair is that `gcloud iam roles create` is used to define a new custom role in an organization or project, not to grant an existing role to a principal. Even after creating the service account, running this command would only create a role definition, leaving the service account without any actual permissions on the project. To grant the service account a role, you must use `gcloud projects add-iam-policy-binding` to add the service account as a member with a predefined or existing custom role.

Go deeper

Related to this question