hardMultiple ChoiceObjective-mapped
Google ACE Practice Question: Refer to the exhibit
Exhibit
ERROR: (gcloud.deployment-manager.deployments.create) The user does not have permission to use service account 'my-sa@project.iam.gserviceaccount.com'. Required 'iam.serviceAccounts.actAs' permission.
Refer to the exhibit. A user attempts to create a Deployment Manager deployment that references a service account. What is the most likely issue?
⚠ Common exam trap
Google Cloud often tests the distinction between having permission to create a deployment versus having permission to use a specific service account within that deployment, leading candidates to mistakenly choose the deployment-level permission error (Option A) instead of the IAM role on the service account (Option B).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The user does not have the roles/iam.serviceAccountUser role on the service account
When a Deployment Manager deployment references a service account, the user must have the `roles/iam.serviceAccountUser` role on that service account to impersonate it. Without this role, the deployment fails even if the user has `deploymentmanager.deployments.create` permission, because the service account is used to execute the deployment's resources. Option B correctly identifies this missing IAM binding as the most likely issue.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The user does not have deploymentmanager.deployments.create permission
Why it's wrong here
The error message is specifically about the actAs permission required to impersonate the service account, not about having the overall deployment creation permission. The deploymentmanager.deployments.create permission controls whether the user can submit a deployment, but this failure occurs after that authorization, when the service account is being configured for the deployment resources. If the create permission were missing, the API would reject the request earlier without referencing a specific service account.
- ✓
The user does not have the roles/iam.serviceAccountUser role on the service account
Why this is correct
To use a service account in a Deployment Manager deployment, the user must have the roles/iam.serviceAccountUser role on that service account, which grants the serviceAccounts.actAs permission. This permission allows the user to impersonate the service account when creating resources on behalf of the deployment. The error 'permission serviceAccounts.actAs required' confirms that this IAM binding is missing, making this the correct answer.
- ✗
The service account is disabled
Why it's wrong here
If the service account were disabled, the error would state that the service account is disabled or its credentials are invalid, not that an IAM permission is missing. A disabled service account cannot be used, but that condition produces a 403 or 400 error about the account's status. The current error references 'actAs', which is an authorization failure, not a state-related failure.
- ✗
The service account does not exist
Why it's wrong here
If the service account did not exist, the API would return a 'not found' error, such as HTTP 404 or 'Service account example@project.iam.gserviceaccount.com does not exist'. The error in the exhibit indicates the service account was identified and looked up successfully, and the only problem is a missing permission to act as it. Therefore, the account's existence is not in question, making this option incorrect.
Go deeper
Related to this question
Learn chapter
Deployment Manager and Terraform on GCP
Key term
Service
A service is a software component or system that performs a specific function and is available to be used by other programs or users over a network.
Key term
Deployment Manager
Deployment Manager is a Google Cloud service that lets you define and manage your cloud resources using declarative templates, so you can create, update, and delete infrastructure as a single unit.
About these practice questions
Courseiva writes every ACE question from scratch — 769 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.