Google ACE Setting Up a Cloud Solution Environment Practice Question
An administrator needs to create a custom IAM role that allows listing projects and viewing billing accounts. Which TWO permissions should be included?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
billing.accounts.list
resourcemanager.projects.list and billing.accounts.list allow these actions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
billing.accounts.list
Why this is correct
Correct. The billing.accounts.list permission is the specific IAM permission that allows a principal to enumerate the billing accounts they can access. Including this permission in the custom role is essential and sufficient for the read-only task of listing billing accounts; without it, any API call or console view that attempts to list billing accounts will fail with a permission denied error.
- ✗
billing.accounts.create
Why it's wrong here
Wrong. The billing.accounts.create permission grants the ability to create new billing accounts, a write operation that changes the billing landscape. Listing existing billing accounts requires no such creation capability, so adding this permission is unnecessary and violates the principle of least privilege by granting harmful administrative power to the role.
- ✗
resourcemanager.projects.create
Why it's wrong here
Wrong. The resourcemanager.projects.create permission allows the creation of new Google Cloud projects. This is unrelated to listing billing accounts; it does not contribute to the ability to view billing information. Including this permission would broaden the custom role's scope to project lifecycle management, which is far beyond the required functionality.
- ✓
resourcemanager.projects.list
Why this is correct
Correct. The resourcemanager.projects.list permission is required to list the Google Cloud projects in the resource hierarchy. In the context of a billing-focused role, this permission is necessary to display the projects associated with each billing account, since billing account APIs often return references to projects but the actual project list requires this separate resourcemanager permission.
- ✗
resourcemanager.projects.delete
Why it's wrong here
Wrong. The resourcemanager.projects.delete permission enables the permanent deletion of Google Cloud projects, a destructive and irreversible action. It provides no assistance in listing billing accounts or projects, and including it in a custom role for read-only billing visibility would introduce a severe security risk and violates least privilege.
Go deeper
Related to this question
Learn chapter
GCP IAM and Service Accounts
Key term
IAM role
An IAM role is a set of permissions that an entity can assume temporarily to access cloud resources securely.
Key term
IAM
Identity and Access Management (IAM) is a framework of policies and technologies that ensures the right individuals have the appropriate access to technology resources.
About these practice questions
One of 769 original ACE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.