mediumMultiple ChoiceObjective-mapped
Google ACE Practice Question: A new engineer joins the team and needs access to…
A new engineer joins the team and needs access to GCP. The company uses Google Workspace for identity management. The GCP admin needs to add the engineer and grant them access to one project. What is the correct order of steps?
⚠ Common exam trap
Google Cloud often tests the misconception that GCP users are created inside the GCP Console itself, when in fact human identities must be provisioned through the organization's identity provider (Google Workspace or Cloud Identity) before they can be assigned IAM roles.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create the user in Google Workspace Admin Console, then grant their account IAM roles on the GCP project
Google Workspace is the identity provider (IdP) for the organization, so the engineer must first be created as a user in the Google Workspace Admin Console. Once the user exists, the GCP admin can then grant IAM roles (e.g., roles/viewer, roles/editor) on the specific project, which maps the Workspace user identity to GCP permissions. This follows the principle that GCP IAM relies on existing identities from the Cloud Identity or Workspace domain, not on separate user creation within GCP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a service account for the engineer in GCP, then share the key file
Why it's wrong here
Service accounts are intended for non-human identities used by applications, not for interactive login by engineers. Sharing a service account key file authenticates all actions as that service account, which means there is no individual audit trail and no MFA or lifecycle controls tied to a specific person. A leaked key remains valid until rotated, creating a severe security risk. Human users should authenticate with their own Google account and, if needed, use short-lived credentials like access tokens or impersonation.
- ✓
Create the user in Google Workspace Admin Console, then grant their account IAM roles on the GCP project
Why this is correct
Users are provisioned outside of GCP in the Google Workspace Admin Console (or Cloud Identity), which creates the user’s Google identity. Once that identity exists, you can grant IAM roles on the project, folder, or organization, giving the engineer access to the Console and APIs. This pattern enables centralized lifecycle management, SSO, MFA, and audit for corporate users, and it is the only correct way to create a human user for GCP access.
- ✗
Create a GCP project for the engineer, then add their personal Gmail as a project owner
Why it's wrong here
A personal Gmail account can technically be added as an IAM member, but this bypasses enterprise identity governance because the admin cannot enforce MFA, disable the account, or control password policies. Granting the Owner role on a project gives full control over all resources, billing, and IAM, violating least privilege. Creating a separate project is also wrong; the engineer should be granted scoped IAM roles on the existing project, using their managed Google identity.
- ✗
Create an API key for the engineer in the GCP Console and share it securely
Why it's wrong here
API keys are not authentication credentials for human users; they are long-lived identifiers that simply map API requests to a project for quota and billing purposes. An API key cannot be used to sign in to the Google Cloud Console and does not support MFA or session revocation, so shared keys make actions anonymous and unmanageable. Since an API key is not an IAM principal, granting an engineer a key provides no identity link and no way to audit their individual activity. The correct method is to assign IAM roles to the engineer’s Google account.
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
IAM
Identity and Access Management (IAM) is a framework of policies and technologies that ensures the right individuals have the appropriate access to technology resources.
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
About these practice questions
This ACE question is part of Courseiva's 769-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.