Google ACE Setting Up a Cloud Solution Environment Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Grant the user an IAM role directly; Cloud Identity is not required.

  Why it's wrong here

  Granting an IAM role directly to a user without first provisioning them in Cloud Identity is invalid because IAM principals must correspond to a Google account or a Cloud Identity account. If the user does not already have a Google account in your organization's domain, there is no principal to bind the role to, and the IAM policy cannot even be set. Cloud Identity creates the managed user account that becomes the principal for IAM role binding.

• ✗

  Create a service account for the user and grant roles to the service account.

  Why it's wrong here

  Service accounts are designed for non-human workloads such as virtual machines, Cloud Functions, or scheduled jobs, not for individual human users. If you create a service account for a user, the user would have to obtain and rotate a service account key or use impersonation to act as that service account, which is an anti-pattern. Moreover, all audit log entries would be attributed to the service account rather than the actual person, severely reducing accountability and making identity management fragile.

• ✓

  Add the user to Cloud Identity, then grant the appropriate IAM role in the project.

  Why this is correct

  This is the correct sequence: adding the user to Cloud Identity provisions a managed user account in your organization's directory, which then can be used as a principal in IAM. After the user exists, you grant the appropriate IAM role on the project, and the user can authenticate via their new Cloud Identity account and receive the role's permissions. Without that initial provisioning, the IAM role cannot be assigned to the user at all.

• ✗

  Add the user to a Cloud Identity group, then grant the group an IAM role.

  Why it's wrong here

  Appointing a user to a Cloud Identity group and then granting the group an IAM role is a valid group-based access management strategy, but it is not the immediate next step for a new user. The user must first exist in Cloud Identity as an individual before they can be added to the group. Creating a group, adding the user, and then binding the IAM role introduces unnecessary indirection when the user can simply be added to Cloud Identity and assigned the role directly.

Go deeper

Related to this question