Match each IAM role to its typical access level.
Drag a concept onto its matching description — or click a concept then click the description.
Read-only access to resources
Read and modify resources
Full access including IAM management
Read access to browse the hierarchy
Read access to IAM policies
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Viewer: Read-only access to resources
IAM roles in GCP have predefined permissions: Viewer (read-only), Editor (read/write but no IAM), Owner (full control). Security Admin is a separate role for managing security policies.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Viewer: Read-only access to resources
Why this is correct
The Viewer role is the least privileged primitive IAM role, granting only read-only permissions such as list and get API calls across the assigned scope. It allows you to inspect resource configuration and data but not to create, modify, or delete anything, nor to edit IAM policies. This makes it suitable for auditing or reporting tasks where no changes should be possible.
Editor: Read and write access, but cannot manage IAM policies
Why this is correct
The Editor role builds on Viewer by adding create, update, and delete permissions for most resources, so you can fully operate services and deploy changes. However, it deliberately excludes IAM policy management, meaning you cannot grant or revoke roles for yourself or anyone else. This separation prevents editors from escalating privilege by granting themselves Owner or other high-level roles.
Owner: Full access including IAM management
Why this is correct
The Owner role is the top-level primitive role that includes all Editor permissions plus the ability to manage IAM policies, set billing accounts, and generally administer the resource hierarchy. Owners can add or remove any role assignment, including transferring ownership, which carries significant security responsibility. Unlike Editor, Owner also receives Cloud Audit Logs and is often required for project-level administrative tasks.
Security Admin: Read-only access to resources
Why it's wrong here
Security Admin is not a read-only role; it is a predefined role designed for managing security features such as firewall rules, organizational policies, and specific security-center settings. It includes write permissions for those security controls, so equating it with read-only resource access is inaccurate. The role is intended for security administrators who need to configure protections, not for passive observation.
Viewer: Full access including IAM management
Why it's wrong here
The Viewer role grants only read access to supported resources and explicitly lacks any write or IAM-management permissions. The statement misrepresents the core definition of a viewer, which cannot modify resource configurations, create resources, or change roles. Full access is reserved for Owner, not Viewer, so this pairing is fundamentally incorrect.
Go deeper
Learn chapter
GCP Security Services
Key term
IAM
Identity and Access Management (IAM) is a framework of policies and technologies that ensures the right individuals have the appropriate access to technology resources.
Key term
IAM role
An IAM role is a set of permissions that an entity can assume temporarily to access cloud resources securely.
About these practice questions
Courseiva writes every ACE question from scratch — 769 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.