Google ACE Deploying and Implementing a Cloud Solution Practice Question
You are managing a Cloud Functions deployment that processes messages from a Pub/Sub topic. You need to ensure the function can read messages from the topic and acknowledge them. Which IAM role should you assign to the function's service account?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
roles/pubsub.subscriber
The Pub/Sub Subscriber role (roles/pubsub.subscriber) grants permission to pull messages and acknowledge them. The function's service account needs this role on the topic or subscription.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
roles/pubsub.publisher
Why it's wrong here
The Pub/Sub Publisher role (roles/pubsub.publisher) authorizes a principal to publish messages to a topic, but it grants no permissions on subscriptions. A Cloud Functions background function consumes messages from the underlying subscription; without the ability to pull or acknowledge, the function can never receive the message payload, so the trigger would never execute and messages would remain undelivered.
- ✓
roles/pubsub.subscriber
Why this is correct
The Pub/Sub Subscriber role (roles/pubsub.subscriber) is the correct, least-privileged role for a Cloud Functions trigger. It includes the permissions needed to pull messages (pubsub.subscriptions.consume) and acknowledge them after processing (pubsub.subscriptions.acknowledge), which is exactly what the function's runtime service account must do to read and complete each message from its subscription.
- ✗
roles/pubsub.viewer
Why it's wrong here
The Pub/Sub Viewer role (roles/pubsub.viewer) is limited to read-only metadata operations, such as listing topics and subscriptions and viewing their IAM policies. It does not include any messaging-plane permissions, so a service account holding only this role cannot pull or acknowledge messages, and a Cloud Function with this role would be unable to actually process any Pub/Sub data.
- ✗
roles/iam.serviceAccountUser
Why it's wrong here
The IAM Service Account User role (roles/iam.serviceAccountUser) permits a principal to impersonate a service account and thus act as that service account, but it conveys no Pub/Sub permissions whatsoever. This role is useful for granting access to a service account resource, not for consuming Pub/Sub messages, so it cannot enable the function's trigger to deliver or acknowledge messages.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
Pub/Sub
Pub/Sub is a messaging pattern where publishers send messages without knowing who receives them, and subscribers receive only the messages they care about.
Key term
Cloud Functions
Cloud Functions are serverless compute services that let you run single-purpose code in response to events without managing servers.
About these practice questions
This ACE question is part of Courseiva's 769-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.