Google ACE Practice Question: A GCP project administrator needs to share…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create a service account for the auditor and share the JSON key file

  Why it's wrong here

  Service accounts are intended for application components (VMs, Cloud Functions, etc.) that need to authenticate to Google APIs, not for human users. Sharing a JSON key file exposes long-lived credentials outside the project, creating a severe security risk: the key can be copied, has no built-in MFA, and revocation is cumbersome. Moreover, the auditor would then need to use gcloud with the key to access resources, lacking a proper interactive login; for human access, you should use a Google account with an IAM role like Viewer.

• ✓

  Grant the Viewer role to auditor@gmail.com in the project's IAM policy

  Why this is correct

  Cloud IAM supports granting a role to any Google account, and a Gmail address is a valid principal identifier. The Viewer role (roles/viewer) is a predefined IAM role that encompasses read-only permissions across all services in the project, such as listing compute instances, viewing Cloud Storage buckets, and reading configurations. By assigning this role to auditor@gmail.com in the project IAM policy, the auditor gets exactly the read-only visibility needed without any write or management capabilities.

• ✗

  Add auditor@gmail.com as a project billing admin to give them read-only access

  Why it's wrong here

  Adding auditor@gmail.com as a project billing admin grants them access to the billing account itself, not to project resources. The Billing Admin role (roles/billing.admin) can manage payment methods, budgets, and billing exports, but it does not include permissions like resourcemanager.projects.get or compute.instances.list. Since the auditor needs to review project resources, this role misses entirely; Viewer (roles/viewer) on the project IAM policy is the correct read-only role.

• ✗

  Create a Cloud Identity account for the auditor — Gmail accounts cannot access GCP projects

  Why it's wrong here

  This option falsely assumes Gmail accounts are not valid IAM principals. In Cloud IAM, any Google account, including @gmail.com addresses, can be granted roles on a project as long as they authenticate via Google. Creating a Cloud Identity account would make the auditor part of an organization's identity directory, but it does not automatically grant any access—you still must assign IAM roles. It also may be enterprise-preferred but is an unnecessary extra step, and the Cloud Identity account itself would not be the same principal unless the email is changed.

Go deeper

Related to this question