Google ACE Configuring Access and Security Practice Question
Which IAM role should be granted to a user to allow them to create and manage secrets in Secret Manager?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
roles/secretmanager.admin
roles/secretmanager.admin provides full control over secrets, including creation, deletion, and granting access. roles/secretmanager.secretAccessor only allows reading secret payloads. roles/editor is too broad and not specific. roles/viewer is read-only.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
roles/secretmanager.admin
Why this is correct
roles/secretmanager.admin is the correct choice because it grants the full set of Secret Manager permissions needed to create, update, and delete secrets, versions, and their IAM policies. It includes actions such as secretmanager.secrets.create, secretmanager.secrets.update, secretmanager.secrets.delete, and secretmanager.versions.add, allowing complete lifecycle management without granting unrelated service permissions.
- ✗
roles/secretmanager.secretAccessor
Why it's wrong here
roles/secretmanager.secretAccessor is wrong because it only includes the permission secretmanager.versions.access, which lets a principal retrieve the decrypted payload of a secret version. It cannot create, update, or delete secrets or their versions, nor can it view metadata like secret names or labels, so it is purely for runtime consumption of secret material.
- ✗
roles/editor
Why it's wrong here
roles/editor is wrong because, while it may include the basic mutation permissions on Secret Manager resources, it is a broad predefined role that grants write and delete access to virtually every Google Cloud service, such as Compute Engine, Kubernetes, and Cloud Storage. This violates the principle of least privilege and introduces unnecessary blast radius, making roles/secretmanager.admin far more appropriate for a user whose only job is managing secrets.
- ✗
roles/secretmanager.viewer
Why it's wrong here
roles/secretmanager.viewer is wrong because it is read-only: it includes permissions like secretmanager.secrets.get and secretmanager.secrets.list, allowing a user to inspect secret metadata, but it cannot create, update, or delete secrets. It also does not include secretmanager.versions.access, so the user cannot even read the actual secret payload, making it entirely insufficient for administrative tasks.
Go deeper
Related to this question
Learn chapter
Deployment Manager and Terraform on GCP
Key term
IAM role
An IAM role is a set of permissions that an entity can assume temporarily to access cloud resources securely.
Key term
Secret Manager
A Secret Manager is a centralized tool that securely stores, manages, and controls access to sensitive information like passwords, API keys, and certificates, often automating their rotation and injection into applications.
About these practice questions
This ACE question is part of Courseiva's 769-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.