mediumMultiple ChoiceObjective-mapped
Google ACE Practice Question: An application receives the error 'Permission…
An application receives the error 'Permission denied on resource project [PROJECT_ID] (or it may not exist)' when making an API call with a service account. The service account has the correct IAM role. What else might be missing?
⚠ Common exam trap
Google Cloud often tests the misconception that IAM roles alone guarantee API access, but the trap here is that candidates overlook the prerequisite of enabling the API service in the project, which is a separate step from assigning IAM permissions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The relevant GCP API is not enabled in the project
The error 'Permission denied on resource project [PROJECT_ID] (or it may not exist)' typically occurs when the service account has the correct IAM role but the API being called is not enabled for the project. Even with proper IAM permissions, GCP requires that the specific API (e.g., Compute Engine API, Cloud Storage API) be enabled in the project before any API calls can succeed. Enabling the API activates the service and allows the service account to use it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The service account needs the Project Owner role to make any API calls
Why it's wrong here
Project Owner is a powerful, all-encompassing role that confers full access to all GCP resources, but it is not a prerequisite for making API calls. Each Google Cloud API is governed by finer-grained IAM roles (for example, roles/compute.admin or roles/storage.objectViewer) that grant specific permissions. If the API itself is not enabled, even Owner cannot make successful calls. Therefore, the error is not caused by insufficient role assignment but by the service's disabled state.
- ✓
The relevant GCP API is not enabled in the project
Why this is correct
When the relevant API is disabled in the project, any request using a service account or user credential fails with a message indicating either 'API has not been used' or that the endpoint cannot be reached. Google Cloud requires an API to be enabled per project before its methods are callable, regardless of the caller's IAM roles. Enabling the API via gcloud services enable or the Cloud Console resolves the error and does not require changing IAM roles.
- ✗
The service account needs to be in the same organization as the project
Why it's wrong here
Service account identities can be created in one project and used in another project by adding an IAM binding that names that service account as a principal. There is no Google Cloud requirement that the service account reside in the same organization as the project whose API it is calling. Such cross-project and even cross-organization access works as long as the resource hierarchy allows it and the appropriate IAM permissions are granted on the target project.
- ✗
The service account email must be explicitly allow-listed in the API's configuration
Why it's wrong here
Google Cloud APIs do not maintain an email allow-list separate from IAM. Access is determined exclusively by IAM policies that bind roles to principals, and the API configuration itself has no field for specifying service account emails. If a service account email were unrecognized, you would see an IAM error such as 'permission denied' or 'principal not found', but the message 'API is not enabled' points to the project-level API enablement state.
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
Service
A service is a software component or system that performs a specific function and is available to be used by other programs or users over a network.
Key term
IAM
Identity and Access Management (IAM) is a framework of policies and technologies that ensures the right individuals have the appropriate access to technology resources.
About these practice questions
One of 769 original ACE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.