mediumMultiple ChoiceObjective-mapped
Google ACE Practice Question: Refer to the exhibit
Exhibit
serviceAccounts:
- email: '123456789-compute@developer.gserviceaccount.com'
scopes:
- 'https://www.googleapis.com/auth/devstorage.read_only'
- 'https://www.googleapis.com/auth/logging.write'
- 'https://www.googleapis.com/auth/pubsub'Refer to the exhibit. An application running on this instance is unable to write to a Cloud Storage bucket. What is the most likely cause?
⚠ Common exam trap
Google Cloud often tests the distinction between IAM permissions and access scopes, trapping candidates who assume that a service account with the correct IAM role can always perform the action, ignoring that access scopes can override those permissions at the instance level.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The access scopes only allow read access to Cloud Storage
When an instance is created with access scopes, these scopes restrict the API methods that the instance's credentials can use, regardless of the IAM permissions granted to the attached service account. The exhibit shows that the access scopes are set to 'Read Only' for Cloud Storage, which means the application can only call read methods (e.g., storage.objects.get) and cannot perform write operations (e.g., storage.objects.insert). This overrides any IAM role that would otherwise allow write access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The application is using the wrong authentication method
Why it's wrong here
Using a service account attached to the instance is the correct authentication method for workloads on Compute Engine; the instance obtains OAuth tokens via the metadata server. "Wrong authentication method" would imply the app is using user credentials, API keys, or an unrelated service account, none of which is suggested by the exhibit. The failure is not about how the identity is authenticated, but about the authorization scope granted to that service account's token, which restricts what that identity can do.
- ✓
The access scopes only allow read access to Cloud Storage
Why this is correct
The access scopes configured on the instance determine the OAuth token's capabilities and are enforced in addition to IAM. In the exhibit, the scope is devstorage.read_only, so the token can only perform read operations on Cloud Storage, even if the service account has a write-capable IAM role like storage.objectAdmin. Because GCS writes use the token's scopes, the API call fails with a scope error before IAM is evaluated. To allow writes, you must either update the instance's access scopes or restart with the correct scope.
- ✗
The Cloud Storage bucket is in a different project
Why it's wrong here
While Cloud Storage buckets can be accessed across projects when the caller has appropriate IAM permissions, a different project alone would not cause a persistent "insufficient scopes" or permission error unless the service account lacks IAM roles in that bucket's project. The exhibit does not indicate any cross-project configuration, and the error described aligns with the scope limitation, not project membership. Even if the bucket were in another project, granting IAM roles to the service account would resolve the issue, but changing projects without changing scopes would not here.
- ✗
The service account does not have the storage.objectAdmin IAM role
Why it's wrong here
The service account may indeed lack the storage.objectAdmin IAM role, but that is not the primary or sufficient cause of this failure. Access scopes act as a hard upper bound: even if the service account has storage.objectAdmin, the OAuth token with only devstorage.read_only cannot authorize write operations. In contrast, if the scope were correctly set to cloud-platform or read-write for Storage, then IAM would be the next thing to check. Therefore, the root cause is the read-only scope, not the IAM role assignment.
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
IAM
Identity and Access Management (IAM) is a framework of policies and technologies that ensures the right individuals have the appropriate access to technology resources.
Key term
Cloud storage
Cloud storage is a service that lets you save data on remote servers accessed over the internet instead of on your computer's hard drive.
About these practice questions
One of 769 original ACE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.