Google ACE Setting Up a Cloud Solution Environment Practice Question
An engineer needs to give a data analyst access to run BigQuery queries but prevent them from viewing or modifying data in Cloud Storage. The analyst should be able to create new datasets. Which IAM role should the engineer assign at the project level?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
roles/bigquery.dataEditor
The role roles/bigquery.dataEditor allows creating datasets and querying data, but does not grant any Cloud Storage permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
roles/storage.objectViewer
Why it's wrong here
roles/storage.objectViewer grants read-only access to objects in Cloud Storage buckets, not to BigQuery resources. It does not include any BigQuery permissions such as bigquery.jobs.create or bigquery.tables.getData, so the analyst cannot submit queries or read table data. This role is irrelevant to the stated requirement of running BigQuery jobs and would leave the analyst unable to perform the task.
- ✓
roles/bigquery.dataEditor
Why this is correct
roles/bigquery.dataEditor is the correct choice because it provides the necessary permissions for a data analyst to run queries, including bigquery.jobs.create to execute query jobs and bigquery.tables.getData to read table contents. It also allows creating and updating tables within datasets, striking the right balance between access and control. Unlike broader roles, it does not grant dataset-level deletion or permission management, aligning with the principle of least privilege for a typical analyst use case.
- ✗
roles/bigquery.dataOwner
Why it's wrong here
roles/bigquery.dataOwner grants full control over BigQuery resources, including bigquery.datasets.delete, bigquery.datasets.update, and bigquery.tables.delete, as well as the ability to modify IAM policies on datasets via bigquery.datasets.setIamPolicy. This is far more permissive than an analyst needs and could lead to accidental deletion of datasets or unauthorized exposure of sensitive data. The role violates least privilege and is therefore inappropriate when a more limited editor role suffices.
- ✗
roles/bigquery.user
Why it's wrong here
roles/bigquery.user allows an analyst to submit query jobs (bigquery.jobs.create) and list datasets, but it does not grant bigquery.tables.getData or bigquery.tables.get, which are required to actually read table data. Without these table-level permissions, the analyst would be able to initiate a query but would receive an access denied error when the query tries to access tables. Additionally, it does not permit creating datasets, making it insufficient for the analyst's needs in this scenario.
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
IAM
Identity and Access Management (IAM) is a framework of policies and technologies that ensures the right individuals have the appropriate access to technology resources.
Key term
IAM role
An IAM role is a set of permissions that an entity can assume temporarily to access cloud resources securely.
About these practice questions
This ACE question is part of Courseiva's 769-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.