Google ACE Configuring Access and Security Practice Question
An engineer needs to grant a service account the ability to start and stop Compute Engine instances in a specific project. The service account should not have permissions to delete instances or modify other resources. Which IAM role should be assigned?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
roles/compute.instanceAdmin.v1
The Compute Instance Admin (roles/compute.instanceAdmin.v1) role provides permissions to create, start, stop, and reset instances, but does not include delete permissions. The Compute Admin role is too broad, and Compute Viewer is read-only. Compute OS Admin Login is for OS login, not instance lifecycle.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
roles/compute.viewer
Why it's wrong here
roles/compute.viewer provides read-only access to Compute Engine resources, allowing users to list and inspect instances, disks, and snapshots. However, it does not grant any write operations such as starting or stopping an instance, because those actions require compute.instances.start and compute.instances.stop permissions. Therefore, an engineer with this role cannot change the instance lifecycle state, making it insufficient for the requirement.
- ✗
roles/compute.admin
Why it's wrong here
roles/compute.admin grants full administrative control over Compute Engine, including creating, deleting, and modifying instances, as well as managing networks, firewalls, and other resources. While it does allow starting and stopping instances, it also includes destructive permissions like compute.instances.delete, which are far broader than needed. Granting this role would over-privilege the service account and violate the principle of least privilege, even though the immediate task would be possible.
- ✗
roles/compute.osAdminLogin
Why it's wrong here
roles/compute.osAdminLogin is an IAM role that controls operating system-level login to Compute Engine instances, granting an account the ability to access the guest OS via SSH with administrative rights. It does not provide any permissions to manage the instance lifecycle, such as starting, stopping, or resetting the instance from the Compute Engine API or console. Thus, this role is orthogonal to the required capability and cannot fulfill the start/stop requirement.
- ✓
roles/compute.instanceAdmin.v1
Why this is correct
roles/compute.instanceAdmin.v1 is a predefined IAM role specifically designed for managing Compute Engine instances without granting broader administrative power. It includes permissions to start, stop, and reset instances, as well as modify metadata and change instance settings, but it does not allow deleting instances or creating new ones. This role exactly matches the requirement of enabling a service account to start and stop instances while maintaining least privilege.
Go deeper
Related to this question
Learn chapter
Google Compute Engine
Key term
Service account
A service account is a special type of account used by an application or a virtual machine, rather than a human user, to authenticate and interact with cloud services and APIs securely.
Key term
IAM role
An IAM role is a set of permissions that an entity can assume temporarily to access cloud resources securely.
About these practice questions
Courseiva writes every ACE question from scratch — 769 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.