Courseiva
← ACE
Full test
hardMultiple ChoiceObjective-mapped

Google ACE Practice Question: Refer to the exhibit

Exhibit

IAM policy JSON:
{
  "bindings": [
    {
      "role": "roles/compute.viewer",
      "members": [
        "serviceAccount:sa@project.iam.gserviceaccount.com"
      ],
      "condition": {
        "title": "production_label",
        "expression": "resource.labels.environment == 'production'"
      }
    }
  ]
}

Refer to the exhibit. An administrator wants to grant a service account read-only access to all Compute Engine instances in a project, but only those with label 'environment=production'. Which IAM policy configuration should be used?

⚠ Common exam trap

Google Cloud often tests the distinction between roles that grant read-only access (like roles/compute.viewer) versus roles that grant broader permissions (like roles/compute.instanceAdmin), and the use of correct condition attributes (resource.labels vs. request.host) to filter by resource labels.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

roles/compute.viewer with condition 'resource.labels.environment == "production"'

Roles/compute.viewer provides read-only access to Compute Engine resources, and the condition 'resource.labels.environment == "production"' restricts that access to only instances with the specified label. This satisfies the requirement of granting read-only access to production-labeled instances without granting broader permissions.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    roles/compute.instanceAdmin with condition 'resource.labels.environment == "production"'

    Why it's wrong here

    The compute.instanceAdmin role is too broad because it grants write permissions such as compute.instances.update, compute.instances.delete, and compute.instances.create. Adding a condition on resource.labels.environment only limits which resources the permissions apply to (those labeled production), but it does not alter the role's permission set to read-only. The administrator specifically requested read-only access, so this role violates the principle of least privilege.

  • ✓

    roles/compute.viewer with condition 'resource.labels.environment == "production"'

    Why this is correct

    The compute.viewer role provides read-only permissions for Compute Engine resources, including compute.instances.get, compute.instances.list, and similar operations. The IAM condition resource.labels.environment == "production" restricts the resource's access to only those instances carrying that exact label. This combination precisely meets the administrator's requirement: the service account can view production instances but cannot modify or delete them. The condition is evaluated at access time against the instance's labels, so unlabeled or differently labeled instances are excluded.

  • ✗

    roles/compute.imageUser with condition 'resource.labels.environment == "production"'

    Why it's wrong here

    The compute.imageUser role is designed specifically for using images—for example, to create an instance from a particular image—and offers no permissions to read or view Compute Engine instances themselves. Even if a condition on resource.labels.environment is attached, that condition applies to the role's allowed actions on image resources, not to instance metadata or list operations. Consequently, this role would not grant the desired read-only access to production instances and is the wrong choice.

  • ✗

    roles/compute.viewer with condition 'request.host == "production"'

    Why it's wrong here

    The IAM condition key request.host is not a valid attribute in the resource-based condition syntax used with compute.viewer. In IAM conditions, resource labels are accessed via resource.labels.<label-key>, not request.host, which is not a standard condition key for Compute Engine access. Even if request.host were valid, it would evaluate the hostname from the request header rather than the instance's label, so it would not restrict access to instances labeled environment=production. This condition would fail to provide the intended label-based scoping and would not satisfy the read-only requirement for production resources.

About these practice questions

This ACE question is part of Courseiva's 769-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.