easyMultiple ChoiceObjective-mapped
Google ACE Practice Question: Which console page would you use to create and…
Which console page would you use to create and manage custom IAM roles?
⚠ Common exam trap
Google Cloud often tests the distinction between managing IAM roles (which is done in the Roles page) and managing service accounts (which is done in the Service Accounts page), leading candidates to confuse the two because both involve identity and access management.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
IAM & Admin > Roles
The IAM & Admin > Roles page in the Google Cloud Console is the dedicated interface for creating, editing, and managing custom IAM roles. Custom roles allow you to define a precise set of permissions that are not available in predefined roles, giving you granular control over access to Google Cloud resources. This page also lists all predefined and custom roles, and allows you to clone, delete, or update role definitions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
IAM & Admin > Audit Logs
Why it's wrong here
IAM & Admin > Audit Logs is incorrect because this page aggregates a read-only stream of activity, such as who created, modified, or deleted resources, and which service account or user made the API call. It does not provide any controls to define or edit permission sets. Custom role management requires a page where permissions can be composed and saved, not one that merely reports historical authorization events.
- ✓
IAM & Admin > Roles
Why this is correct
IAM & Admin > Roles is the correct page because it is the dedicated console surface for managing both predefined and custom roles within a project, folder, or organization. From this page you can click "Create Role" to assign a title, description, ID, and select specific permissions to build a custom role, or you can clone and edit existing roles that you own. This page directly supports the lifecycle of custom IAM roles, including editing role permissions, deleting custom roles, and managing role bindings.
- ✗
IAM & Admin > Organization Policies
Why it's wrong here
IAM & Admin > Organization Policies is incorrect because it manages Organization Policy Service constraints, such as "constraints/compute.vmExternalIpAccess" or "constraints/iam.allowedPolicyMemberDomains", which restrict how resources can be configured and which principals are allowed in IAM policies. These policies are applied at the organization or folder nodes and govern resource usage, not the definition of permission sets. Custom roles are composed of service-specific permissions, not organization constraints, so they are managed from the Roles page instead.
- ✗
IAM & Admin > Service Accounts
Why it's wrong here
IAM & Admin > Service Accounts is incorrect because service accounts are IAM identities (principals) used by applications and virtual machines to authenticate and authorize API calls, not containers of permissions. A service account can be granted a role, including a custom role, but the Service Accounts page only handles creating, listing, deleting, and managing keys for these identities. Creating a custom role requires defining a permission set, which is outside the scope of the Service Accounts page and falls under the Roles page.
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
IAM
Identity and Access Management (IAM) is a framework of policies and technologies that ensures the right individuals have the appropriate access to technology resources.
Key term
Google Cloud
Google Cloud is a suite of cloud computing services offered by Google that provides infrastructure, platform, and software solutions over the internet.
About these practice questions
One of 769 original ACE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.