Courseiva
← ACE
Full test
easyMultiple ChoiceObjective-mapped

Google ACE Practice Question: Your company recently migrated to GCP and you are…

Your company recently migrated to GCP and you are the new cloud administrator. You need to ensure that only specific members of the DevOps team can perform administrative actions on Compute Engine instances, such as starting, stopping, and resetting instances, but not creating or deleting them. You also want to prevent them from modifying firewall rules or other network settings. The team consists of 10 members. You have already created a custom role with the necessary permissions and assigned it to a Google Group that contains all team members. However, you receive a report that a team member was able to accidentally delete a production instance. Upon investigation, you find that the team member had been granted the roles/compute.instanceAdmin role in addition to your custom role by another administrator. What should be the best course of action to prevent this from happening again while still allowing the team to perform their intended tasks?

⚠ Common exam trap

Google Cloud often tests the misconception that you can simply 'block' a specific action (like deletion) via a policy or condition, rather than understanding that IAM permissions are additive and the only way to prevent an action is to remove the role that grants it.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Remove the compute.instanceAdmin role from the team member and audit all user assignments for role conflicts.

The core issue is that the team member had an additional, more permissive role (roles/compute.instanceAdmin) that overrode the restrictions of your custom role. Removing that conflicting role from the specific user and auditing all assignments ensures that only the intended permissions are applied, preventing accidental deletions while preserving the team's ability to start, stop, and reset instances.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✓

    Remove the compute.instanceAdmin role from the team member and audit all user assignments for role conflicts.

    Why this is correct

    Removing the compute.instanceAdmin role from the team member is the correct remediation because that role contains the instances.delete permission, which directly conflicts with the custom role's intent to allow only stop/start actions. Auditing all user assignments afterward is essential to catch similar role conflicts where a broader predefined role may override a more restrictive custom role, ensuring least privilege across the project.

  • ✗

    Create an organization policy to block deletion of compute instances.

    Why it's wrong here

    Creating an organization policy to block deletion of compute instances is far too broad and would apply to every user and service account in the organization, not just this team member. It also prevents legitimate deletions that other roles or automated processes need to perform, so it disrupts normal operations rather than fixing the underlying IAM misconfiguration.

  • ✗

    Remove the custom role from the team member and keep only the compute.instanceAdmin role.

    Why it's wrong here

    Removing the custom role and keeping only the compute.instanceAdmin role would actually make the problem worse, because compute.instanceAdmin includes instances.delete. The team member would retain the exact deletion permission the custom role was designed to prevent, so this action does not resolve the conflict and violates the principle of least privilege.

  • ✗

    Use IAM conditions on the custom role to enforce that instances can only be stopped during business hours.

    Why it's wrong here

    Applying IAM conditions to the custom role to restrict stopping instances to business hours does not address the deletion permission at all. The compute.instanceAdmin role still grants instances.delete unconditionally, and IAM conditions on the custom role only affect the permissions in that custom role, not the permissions granted by the separate, broader role.

About these practice questions

One of 769 original ACE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.