Google ACE Practice Question: Arrange the steps to create a Compute Engine…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  First create the custom service account, then grant the appropriate IAM roles to it, and finally create the Compute Engine instance specifying that service account.

  Why this is correct

  This is the correct order because the service account must exist before it can be attached to an instance, and assigning roles before instance creation ensures the instance has the necessary permissions from the start.

• ✗

  First grant IAM roles to a service account, then create the service account, and finally create the Compute Engine instance with that service account.

  Why it's wrong here

  This order fails because IAM roles cannot be bound to a service account that does not yet exist. When you attempt to grant a role before creating the service account, the IAM API returns a 'not found' error since the principal is not a valid resource. Only after the service account is created can you attach IAM roles as policy bindings, and the instance requires that same existing identity to be referenced in its metadata.

• ✗

  First create the Compute Engine instance, then create the custom service account, and finally grant IAM roles to the service account.

  Why it's wrong here

  The instance cannot be created with a reference to a custom service account that is nonexistent at that moment. Compute Engine validates the service account's resource name during instance creation, and if it does not exist, the creation API call is rejected. Creating the service account and binding roles afterward does not retroactively attach it to the already-created instance, leaving the instance associated with the default service account instead.

• ✗

  First create the custom service account, then create the Compute Engine instance with that service account, and finally grant IAM roles to the service account.

  Why it's wrong here

  Even though the service account exists, attaching it to an instance before granting IAM roles means the instance starts without the identities needed to call Google Cloud APIs. Permissions are evaluated at access time, but the instance's local credentials and scopes may not reflect roles granted later until the instance is restarted or the credential metadata is refreshed. To ensure the instance can perform its intended tasks from boot, IAM roles must be assigned to the service account prior to creating the instance.

Go deeper

Related to this question