Google ACE Setting Up a Cloud Solution Environment Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  roles/compute.admin

  Why it's wrong here

  This role grants full control over all Compute Engine resources, including networks, firewalls, disks, images, and instances. It also includes the ability to create and manage instance groups, snapshots, and other low-level networking resources. That's broader than needed because the user only needs to create and manage instances, not manage the underlying VPC networks or security policies.

• ✓

  roles/compute.instanceAdmin.v1

  Why this is correct

  This role is scoped specifically to compute instances. It allows creating, deleting, starting, stopping, and modifying instances, but not managing networks, subnets, firewalls, or other global Compute Engine resources. This is the correct least-privilege choice because it covers all instance lifecycle operations without granting access to the broader infrastructure.

• ✗

  roles/editor

  Why it's wrong here

  This is a basic role that grants the same permissions across many services, allowing users to create, modify, and delete resources in Cloud Storage, BigQuery, App Engine, and more. It's overly permissive for a user who only needs to manage VM instances, as it exposes unrelated services to potential errors or attacks. The principle of least privilege dictates using a more focused role.

• ✗

  roles/owner

  Why it's wrong here

  The owner role includes editor permissions plus the ability to manage IAM policies, billing accounts, and delete entire projects. It grants full administrative control over all resources and access decisions, which goes far beyond the simple task of instance management. Using owner for this would violate least privilege and create unacceptable security risks.

Go deeper

Related to this question