mediumMultiple ChoiceObjective-mapped
Google ACE Practice Question: A platform admin creates a new GCP project for a…
A platform admin creates a new GCP project for a team. The team lead's email is teamlead@company.com. The admin needs the team lead to be able to create resources in the project but not manage IAM policies or billing. Which role is most appropriate?
⚠ Common exam trap
Google Cloud often tests the distinction between resource-level permissions and management-level permissions, and the trap here is that candidates may confuse the Editor role with Owner because both can create resources, but only Owner can manage IAM and billing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Editor
The Editor role (roles/editor) grants all permissions necessary to create, modify, and delete resources within a GCP project, but explicitly excludes permissions to manage IAM policies (roles/iam.securityAdmin or roles/owner) and billing (roles/billing.admin). This makes it the correct choice for a team lead who needs to deploy and manage resources without having the ability to change access controls or alter billing configurations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Owner
Why it's wrong here
Owner grants full administrative control, including the ability to modify IAM policies and manage billing accounts. This exceeds the team lead's needs and introduces significant security risk, as an Owner can grant access to others or change billing settings. The principle of least privilege suggests assigning only the permissions actually required, making Owner inappropriate when IAM and billing management should remain separate.
- ✓
Editor
Why this is correct
Editor provides create, read, update, and delete permissions on all GCP resources, but explicitly excludes IAM policy changes and billing management. This aligns exactly with the team lead's requirement to create and manage resources without managing access controls or billing. It is a primitive role that is broader than needed for many tasks, but in this scenario it matches the stated need precisely without overprivileged access.
- ✗
Viewer
Why it's wrong here
Viewer is a read-only IAM role that permits listing and viewing GCP resources but does not allow any create, update, or delete operations. Since the team lead must create resources to perform their job, this role is too restrictive and fails the core requirement. The team lead would be unable to deploy or modify any infrastructure with Viewer alone.
- ✗
Billing Account Administrator
Why it's wrong here
Billing Account Administrator is a billing-level role that allows managing billing accounts, creating billing account budgets, and linking projects to a billing account, but it grants no permissions to create or manage resources inside a project. Even with this role, the team lead cannot deploy virtual machines, storage buckets, or other services. Thus, it does not satisfy the requirement to create resources and is focused entirely on financial administration.
Go deeper
Related to this question
About these practice questions
This ACE question is part of Courseiva's 769-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.