Google ACE Setting Up a Cloud Solution Environment Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  gcloud iam service-accounts create viewer --permissions="compute.instances.list,compute.instances.get"

  Why it's wrong here

  This command misuses the service-accounts resource: a service account is an identity (a member) for APIs and workloads, not a container for permissions. Additionally, `gcloud iam service-accounts create` accepts no `--permissions` flag, so the command would fail with an unrecognized flag error. To grant permissions, you would create a custom IAM role via `gcloud iam roles create` and then bind it to a principal.

• ✗

  gcloud iam roles create viewer --organization=123456 --permissions="compute.instances.*"

  Why it's wrong here

  This command targets the organization level instead of the project, and more critically uses a wildcard `*` in the permissions list. Custom IAM roles do not allow wildcards; every permission must be explicitly enumerated, so `compute.instances.*` is invalid and would be rejected by the API. Even if wildcards were allowed, it would grant every `compute.instances` permission, violating the principle of least privilege for a viewer role.

• ✓

  gcloud iam roles create viewer --project=my-project --permissions="compute.instances.list,compute.instances.get"

  Why this is correct

  This is the correct command: `gcloud iam roles create` creates a custom role scoped to the specified project, and the `--permissions` flag explicitly lists the two required read-only permissions. Using specific permission names without wildcards enforces least privilege and aligns with IAM's requirement for fully qualified permission identifiers. The resulting role can then be bound to users or groups with `gcloud projects add-iam-policy-binding`.

• ✗

  gcloud iam custom-roles create viewer --project=my-project --permissions='compute.instances.list,compute.instances.get'

  Why it's wrong here

  The `gcloud iam custom-roles create` subcommand does not exist in the Google Cloud CLI. The correct command group is `gcloud iam roles`, with the resource type `roles`; using a nonexistent verb yields an `ERROR: unknown command` message. The single quotes around the permissions are syntactically valid in a shell, but the command itself is fatally wrong because of the invalid subcommand path.

Go deeper

Related to this question