Google ACE Configuring Access and Security Practice Question
Which TWO of the following are valid ways to grant IAM roles to a service account for accessing a Cloud Storage bucket? (Select 2 correct answers)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use gcloud storage buckets add-iam-policy-binding to grant the role directly on the bucket.
IAM roles can be granted at the bucket level using gcloud storage buckets add-iam-policy-binding (or gsutil iam ch) or at the project level which applies to all buckets in the project. The other options are incorrect: gcloud iam roles create creates a custom role definition, not a grant; gcloud iam service-accounts add-iam-policy-binding grants roles on the service account itself; and gcloud projects set-iam-policy replaces the entire policy, not a granular add.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use gcloud projects set-iam-policy with a policy file that includes the binding.
Why it's wrong here
The `gcloud projects set-iam-policy` command replaces the entire IAM policy for the project with the policy specified in the file. While you could include the desired binding in that policy, this approach is error-prone because it overwrites all existing bindings; you must first call `projects get-iam-policy` and manually merge. For a simple grant, `add-iam-policy-binding` is designed to modify only the specific binding, so this is not a recommended or direct way to grant a role.
- ✓
Use gcloud storage buckets add-iam-policy-binding to grant the role directly on the bucket.
Why this is correct
`gcloud storage buckets add-iam-policy-binding` is the dedicated command to add a single IAM binding on a specific Cloud Storage bucket. You specify the bucket name with `--member` and `--role` to grant that role directly to a user, group, or service account at the bucket level. This is a valid, surgical way to grant permissions to exactly that bucket and no other resource.
- ✗
Use gcloud iam roles create to assign the role to the service account.
Why it's wrong here
The `gcloud iam roles create` command defines a new custom IAM role by specifying its title, description, and a set of permissions. It does not attach the role to any member or service account, so it cannot be used to grant or assign the role. To assign a role, you must bind the role to a member using `add-iam-policy-binding` on a project, folder, or resource, or use `gcloud projects set-iam-policy`.
- ✓
Use gcloud projects add-iam-policy-binding to grant the role at the project level.
Why this is correct
`gcloud projects add-iam-policy-binding` adds an IAM binding at the project level, granting the specified role to the member for the entire project. Because IAM permissions propagate through the resource hierarchy, this inherited grant applies to all Cloud Storage buckets in the project, making it a valid way to grant the role on those buckets. It is the recommended method for project-scoped IAM grants.
- ✗
Use gcloud iam service-accounts add-iam-policy-binding.
Why it's wrong here
`gcloud iam service-accounts add-iam-policy-binding` modifies the IAM policy of the service account itself, controlling which principals can act as or administer that service account. It does not grant permissions to the service account on other resources like a Cloud Storage bucket. To grant the service account access to a bucket, you must bind the role to the service account as a member on the bucket or project, using the appropriate add-iam-policy-binding command.
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
IAM
Identity and Access Management (IAM) is a framework of policies and technologies that ensures the right individuals have the appropriate access to technology resources.
Key term
Cloud storage
Cloud storage is a service that lets you save data on remote servers accessed over the internet instead of on your computer's hard drive.
About these practice questions
One of 769 original ACE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.