easyMultiple ChoiceObjective-mapped
Google ACE Practice Question: A user wants to use gcloud to create a Cloud…
A user wants to use gcloud to create a Cloud Storage bucket but receives a permission denied error. What is the most likely cause?
⚠ Common exam trap
Google Cloud often tests the distinction between authentication (who you are) and authorization (what you can do), so the trap here is that candidates may confuse a permission denied error with an authentication failure or a naming conflict.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The user does not have storage.buckets.create permission
C is correct because Cloud Storage uses IAM permissions to control access to bucket creation. The specific permission required is `storage.buckets.create`, which must be granted at the project level. Without this permission, the gcloud command will fail with a permission denied error, even if the user is authenticated and billing is enabled.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The bucket name is already taken
Why it's wrong here
Cloud Storage bucket names are globally unique across all projects, so if the name is already taken, gcloud returns a 409 Conflict error with a message like 'bucket already exists' or 'A Cloud Storage bucket named...' This is a naming collision, not an authorization failure. The permission-denied error in the scenario would not occur when the bucket name is unavailable.
- ✗
The user is not authenticated
Why it's wrong here
If the user were not authenticated, gcloud would fail before making an IAM authorization decision, typically with a 401 Unauthorized status or an authentication prompt/error. 'Permission denied' is a 403 Forbidden response, which only occurs after the user's identity has been verified. Therefore, the error indicates the user is authenticated but lacks the necessary IAM permission, not that they failed to log in.
- ✓
The user does not have storage.buckets.create permission
Why this is correct
The gcloud storage buckets create command calls the Cloud Storage API, which verifies that the authenticated user has the storage.buckets.create permission on the project. A 'permissionDenied' error indicates a missing IAM role, such as Storage Admin (roles/storage.admin) or a custom role containing that permission. Since the request is authenticated but not authorized, this is the correct explanation.
- ✗
The project does not have billing enabled
Why it's wrong here
Cloud Storage bucket creation requires billing to be enabled on the project, but a disabled billing account produces a billing-specific error, such as 'Billing must be enabled for the project' or a 403 with a billing-related reason, never a generic 'permissionDenied' IAM error. Billing enforcement is orthogonal to IAM; even if billing is off, a user with create permission would receive a billing failure, not an access-denied message. Thus this option is incorrect.
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
Cloud storage
Cloud storage is a service that lets you save data on remote servers accessed over the internet instead of on your computer's hard drive.
Key term
IAM
Identity and Access Management (IAM) is a framework of policies and technologies that ensures the right individuals have the appropriate access to technology resources.
About these practice questions
Courseiva writes every ACE question from scratch — 769 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.