easyMultiple ChoiceObjective-mapped
Google ACE Practice Question: A junior developer needs read-only access to all…
A junior developer needs read-only access to all GCP resources in a project. Which IAM role grants the minimum permissions required?
⚠ Common exam trap
Google Cloud often tests the distinction between Viewer and Browser, where candidates mistakenly choose Browser thinking it is the minimal read-only role, but Browser only provides access to browse the project listing and not to read actual resource data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Viewer
The Viewer role (roles/viewer) grants read-only access to all GCP resources in a project, including existing and future resources, without allowing any modifications. This is the minimum permissions required for read-only access, as it provides exactly the necessary permissions (e.g., resourcemanager.projects.get, storage.objects.list) without any write or administrative capabilities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Editor
Why it's wrong here
Editor is a basic IAM role that grants full read, write, update, and delete permissions on virtually all project resources, including the ability to deploy services, modify configurations, and alter data. It does not include IAM policy management or billing access, but it is far beyond read-only because it can make destructive changes. Assigning Editor for a read-only task violates least privilege and unnecessarily increases the blast radius if the user's credentials are compromised.
- ✗
Owner
Why it's wrong here
Owner is the most privileged basic IAM role, encompassing all Editor permissions plus the ability to manage IAM policies, set billing accounts, and control project ownership. This means an Owner can grant or revoke access for other users, change budget configurations, and take full administrative control. Using Owner for read-only access is a severe privilege escalation and a violation of separation of duties, since the user could alter access controls or financial settings without needing any of those capabilities.
- ✓
Viewer
Why this is correct
Viewer is the correct read-only basic role because it includes get and list permissions across most Google Cloud services while granting no create, update, or delete rights. It is the least privileged of the standard roles that can actually inspect project resources, making it the appropriate baseline for monitoring, auditing, and read-only troubleshooting. Unlike Browser, Viewer can see resource data such as VM configurations, bucket contents, and log entries, not just project hierarchy metadata.
- ✗
Browser
Why it's wrong here
Browser is a basic role with only minimal permissions to explore the project hierarchy, such as viewing project names, IDs, and structure. It does not grant read access to the actual resources or data inside those projects, so a user with Browser cannot inspect Compute Engine instances, Cloud Storage objects, or other service resources. This makes Browser strictly less capable than Viewer and unsuitable for a task that requires reading resource information.
Go deeper
Related to this question
Learn chapter
GCP Storage Solutions
Key term
IAM role
An IAM role is a set of permissions that an entity can assume temporarily to access cloud resources securely.
Key term
IAM
Identity and Access Management (IAM) is a framework of policies and technologies that ensures the right individuals have the appropriate access to technology resources.
About these practice questions
Courseiva writes every ACE question from scratch — 769 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.