mediumMultiple ChoiceObjective-mapped
Google ACE Practice Question: Instead of granting IAM roles to 50 individual…
Instead of granting IAM roles to 50 individual developer email addresses, a team wants to manage access by team membership. When a developer joins or leaves, access updates automatically. What is the recommended approach?
⚠ Common exam trap
A common mix-up: candidates confuse service accounts with user identities or think that Cloud IAP can manage IAM roles, when in fact IAP only controls access to applications and not to GCP resource-level permissions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Grant IAM roles to a Google Group containing all team members
Google Groups act as identity containers that can be granted IAM roles at the project or resource level. When developers are added to or removed from the group, their IAM permissions automatically update without requiring manual role changes for each individual user. This aligns with the principle of least privilege and simplifies access management at scale.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a service account shared by all developers on the team
Why it's wrong here
A single shared service account for all developers is an anti-pattern for human access. Service accounts are designed for non-human workloads and authenticate via long-lived keys or workload identity; using one for human users means every action appears under the same principal, destroying audit trails and individual accountability. Key rotation becomes disruptive when many developers depend on the same credential, and any leaked key exposes the entire team. IAM roles should be assigned to user identities or groups, not a shared robot account.
- ✓
Grant IAM roles to a Google Group containing all team members
Why this is correct
Google Groups can be used as an IAM principal, and roles granted to the group apply to every member automatically. When team members are added to or removed from the group in the Google Admin console or Cloud Identity, their Google Cloud permissions update without anyone having to edit IAM policies directly. This centralizes membership management and avoids per-user service account key handling. It is the recommended pattern for human teams because it couples IAM role grants to an identity directory that already reflects the organization's structure.
- ✗
Create a GCP project per developer and use cross-project IAM bindings
Why it's wrong here
Creating a dedicated Google Cloud project for each developer fragments IAM policy, billing, and resource management across many projects. Cross-project IAM bindings still require manually assigning each developer to each project containing shared resources, so they do not provide a single control point for team access. The overhead of maintaining dozens of projects, VPC networks, and service accounts far outweighs any isolation benefit, and shared resources would still need a consistent group-based access strategy. This approach complicates rather than solves centralized team membership management.
- ✗
Use Cloud Identity-Aware Proxy to manage team membership
Why it's wrong here
Cloud Identity-Aware Proxy (IAP) is a security layer that verifies user identity and enforces context-aware access policies at the application or service level, not at the Cloud IAM resource hierarchy level. IAP can be used to protect individual apps, but it does not manage IAM role assignments across projects or act as an identity directory for team members. Adding or removing a user from IAP's access lists only affects the specific protected application and does not grant that user broader Google Cloud resource permissions. To manage team membership for IAM roles, you need Google Groups, not IAP.
Go deeper
Related to this question
About these practice questions
Courseiva writes every ACE question from scratch — 769 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.