Google ACE Configuring Access and Security Practice Question
You need to grant a user the ability to view audit logs for a project but not modify any resources. Which predefined IAM role should you assign?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
roles/logging.viewer
The roles/logging.viewer role provides read-only access to logs, including audit logs. roles/iam.securityReviewer provides read access to IAM policies but not logs. roles/viewer is too broad. roles/owner is administrative.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
roles/iam.securityReviewer
Why it's wrong here
roles/iam.securityReviewer grants permissions to read IAM policies and roles (e.g., iam.roles.get, iam.policies.get) but does not include any Cloud Logging permissions. Audit logs are served by the Cloud Logging API, so this role cannot query log entries. The user would need a logging-specific role to view audit logs.
- ✗
roles/owner
Why it's wrong here
roles/owner is a primitive role that grants full management access to the project, including permission to change IAM policy, modify resources, and manage billing. While an owner could technically read audit logs, that requires assigning an extremely broad set of permissions beyond the narrow task of viewing logs. It violates the principle of least privilege and is not the correct minimal role.
- ✗
roles/viewer
Why it's wrong here
roles/viewer is a primitive role that grants read-only access to most GCP resources, but it was not designed for Cloud Logging: it does not include the specific logging.logEntries.list permission required to read audit logs. Additionally, Viewer's scope is too broad because it allows read access to all resources, which is more than needed. The appropriate role is a logging-specific viewer.
- ✓
roles/logging.viewer
Why this is correct
roles/logging.viewer is the predefined role for read-only access to Cloud Logging data. It includes permissions such as logging.logEntries.list, logging.logEntries.get, and logging.logs.list, which are required to view audit logs in the Logs Explorer. This role cannot modify log sinks or delete logs, providing the least-privileged access to view audit logs.
Go deeper
Related to this question
Learn chapter
Cloud Monitoring and Logging
Key term
IAM
Identity and Access Management (IAM) is a framework of policies and technologies that ensures the right individuals have the appropriate access to technology resources.
Key term
IAM role
An IAM role is a set of permissions that an entity can assume temporarily to access cloud resources securely.
About these practice questions
Courseiva writes every ACE question from scratch — 769 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.