mediumMultiple ChoiceObjective-mapped
Google ACE Practice Question: A Cloud Identity admin needs to grant a user…
A Cloud Identity admin needs to grant a user access to manage billing for a specific GCP project without giving them access to any other projects in the organization. Which role should be assigned at the project level?
⚠ Common exam trap
A common mix-up: candidates confuse the Project Billing Manager role with the Billing Account User role, mistakenly thinking the latter provides project-level billing management, when in fact it only allows linking projects to a billing account and does not grant billing management permissions for a specific project.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Project Billing Manager on the specific project
The Project Billing Manager role is the correct choice because it grants permissions to manage billing for a specific GCP project, including viewing billing reports and setting budget alerts, without providing access to other projects. This role is assigned at the project level, ensuring the user's billing management scope is limited to that single project.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Billing Account Administrator at the organization level
Why it's wrong here
Billing Account Administrator at the organization level is wrong because it grants full management of all billing accounts in the organization, including creating or closing billing accounts, modifying payment instruments, and delegating billing roles. This is far broader than the task of changing the billing account for a single project, violates least privilege, and is typically reserved for finance administrators.
- ✓
Project Billing Manager on the specific project
Why this is correct
Project Billing Manager on the specific project is correct because the role roles/billing.projectManager includes billing.projects.update, which permits linking or unlinking a billing account to precisely that project. It is scoped at the project level, so the user gains no access to other projects or to the billing account's administrative settings, satisfying least privilege.
- ✗
Editor on the specific project
Why it's wrong here
Editor on the specific project is wrong because although roles/editor includes broad read/write control over project resources, it lacks billing.projects.update and therefore cannot change the project's billing association. Granting Editor also exposes the user to management of compute, storage, IAM, and other resources, which is excessive for a billing-linkage task.
- ✗
Billing Account User at the billing account level
Why it's wrong here
Billing Account User at the billing account level is wrong because roles/billing.user lets a user attach that billing account to new projects, but it does not grant the ability to change billing for an existing project. Since the permission applies across the entire billing account, it also over-scopes to all future projects rather than the specific one named.
Go deeper
Related to this question
About these practice questions
One of 769 original ACE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.