Cloud Digital Leader Google Cloud Security Practice Question
A company wants to enforce the principle of least privilege by granting a service account only the permissions necessary to publish messages to a specific Pub/Sub topic. Which IAM approach should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Grant the roles/pubsub.publisher role to the service account at the topic level
IAM allows granting roles at specific resource levels. To grant only publish permission on a specific topic, you should add the service account as a member and assign the Pub/Sub Publisher role (roles/pubsub.publisher) directly on that topic. Granting the role at the project level would give too broad access. Using a custom role with only the required permission is also correct but more complex; however, the simplest correct approach among the options is to assign a predefined role at the topic level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Grant the roles/editor role to the service account at the project level
Why it's wrong here
The roles/editor predefined role includes permissions to modify most Google Cloud resources, such as creating/deleting Pub/Sub topics, changing IAM policies, and modifying Compute Engine instances. Assigning it at the project level gives the service account write access to every resource in the project, including all current and future topics, which vastly exceeds the single publish action needed. This violates least privilege by granting broad, non-targeted edit capabilities that could lead to accidental or malicious changes across the entire project.
- ✗
Grant the roles/pubsub.subscriber role to the service account at the topic level
Why it's wrong here
The roles/pubsub.subscriber role grants permissions for consuming messages, such as subscriptions.consume and subscriptions.pull, but does not include pubsub.topics.publish. Even when applied at the topic level, this role enables the service account to only receive messages from a subscription (or possibly use the subscription attached to the topic) but not to publish to the topic itself. Therefore, the service account would be unable to perform the required publish action, making this an incorrect assignment for the stated need.
- ✓
Grant the roles/pubsub.publisher role to the service account at the topic level
Why this is correct
The roles/pubsub.publisher role contains exactly the pubsub.topics.publish permission required to send messages to a topic. Attaching this role as a binding on the specific topic resource restricts the grant to that single topic, so the service account cannot publish to any other topics in the project. This is the least-privilege approach because it grants the minimal permission on the narrowest resource scope that still fulfills the requirement.
- ✗
Grant the roles/pubsub.publisher role to the service account at the project level
Why it's wrong here
Although the roles/pubsub.publisher role provides the correct publish permission, applying it at the project level means the service account can publish to every topic in the project, including those unrelated to its intended function. This is broader than necessary and violates the principle of least privilege because the service account only needs to publish to one specific topic. The IAM policy should be attached to the topic resource itself, not the encompassing project.
Go deeper
Related to this question
Learn chapter
Compute Options on Google Cloud
Key term
Custom role
A custom role is a user-defined set of permissions in Google Cloud that you can tailor to fit specific job functions beyond the predefined roles.
Key term
Project
A project is a temporary endeavor with a defined beginning and end, undertaken to create a unique product, service, or result, managed through specific processes in IT environments.
About these practice questions
Courseiva writes every GCDL question from scratch — 829 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.