mediumMultiple Choice
Google ACE Practice Question: A team wants to grant three developers access to…
A team wants to grant three developers access to view Cloud SQL instance details and connection strings, but not create, delete, or modify any Cloud SQL instances. Which predefined IAM role is the most appropriate?
⚠ Common exam trap
Google Cloud often tests the distinction between roles that grant operational access (like Cloud SQL Client) versus read-only access (like Cloud SQL Viewer), and the trap here is that candidates may confuse 'Client' with 'Viewer' because both sound like they provide access, but only Viewer grants the ability to see instance details and connection strings without modification permissions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud SQL Viewer
The Cloud SQL Viewer role (roles/cloudsql.viewer) grants read-only permissions to view Cloud SQL instance details, including connection strings, without allowing any create, delete, or modify operations. This matches the requirement precisely, as it provides the necessary visibility while preventing any changes to the instances.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud SQL Editor
Why it's wrong here
Cloud SQL Editor (roles/cloudsql.editor) is a write-level role: it permits creating, updating, and deleting Cloud SQL instances, as well as modifying their configurations and credentials. Because the user only needs to view instance details and connection info, granting Editor grants far broader permissions that could result in unintended changes or downtime, directly violating the principle of least privilege.
- ✗
Cloud SQL Client
Why it's wrong here
Cloud SQL Client (roles/cloudsql.client) is designed for connecting to and using Cloud SQL databases—it allows establishing connections via the Cloud SQL Proxy, client libraries, or JDBC/MySQL clients. However, it does not include any metadata or read permissions on instance configuration (machine type, IP addresses, SSL settings, or console details); it only covers data-plane access, not the control-plane read access required to view instance settings.
- ✓
Cloud SQL Viewer
Why this is correct
Cloud SQL Viewer (roles/cloudsql.viewer) is the exact least-privilege role for read-only inspection of Cloud SQL instances. It grants the ability to list and get instance details, including machine configuration, IP addresses, and connection information, without permitting any write operations, deletions, or modifications. This role satisfies the requirement to view instance details while preventing changes, making it the correct choice.
- ✗
Project Viewer
Why it's wrong here
Project Viewer (roles/viewer) does allow read-only access to Cloud SQL instance details, but it also grants read access to every other project resource, including VPC networks, Compute Engine instances, and IAM policies. This is needlessly broad: the user only needs Cloud SQL-specific read visibility, and exposing unrelated resource metadata expands the attack surface and violates least privilege when a narrower role exists.
Go deeper
Related to this question
Learn chapter
Private Google Access and Private Service Access
Key term
Cloud SQL
Cloud SQL is a fully managed relational database service that lets you set up, maintain, and scale SQL databases (like MySQL, PostgreSQL, and SQL Server) in the cloud without managing the underlying infrastructure.
Key term
IAM
Identity and Access Management (IAM) is a framework of policies and technologies that ensures the right individuals have the appropriate access to technology resources.
About these practice questions
One of 775 original ACE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.