Cloud Digital Leader Google Cloud Security Practice Question
A developer needs to allow a Compute Engine VM to read from a specific Cloud Storage bucket. Which IAM role should be granted to the VM's service account?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
roles/storage.objectViewer
The roles/storage.objectViewer role grants read access to objects in a bucket.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
roles/storage.objectViewer
Why this is correct
roles/storage.objectViewer grants storage.objects.get and storage.objects.list, which allow the VM to read object contents and list objects within a bucket without any write, delete, or admin permissions. This precisely matches the requirement of only reading from Cloud Storage and follows least privilege by not granting any unnecessary capabilities.
- ✗
roles/storage.legacyBucketReader
Why it's wrong here
roles/storage.legacyBucketReader is a legacy IAM role that only permits listing objects in a bucket (storage.objects.list) but does not grant storage.objects.get, so it cannot actually read the contents of the objects. Moreover, this role is applied at the bucket level and is deprecated in favor of the modern predefined objectViewer role, making it both insufficient and not recommended for new IAM bindings.
- ✗
roles/storage.admin
Why it's wrong here
roles/storage.admin grants full control over Cloud Storage resources, including creating, deleting, and updating buckets and objects, as well as modifying IAM policies (storage.buckets.*, storage.objects.*). Attaching this role to the VM's service account violates the principle of least privilege by providing far more access than needed to merely read objects, creating a security risk if the VM is compromised.
- ✗
roles/storage.objectCreator
Why it's wrong here
roles/storage.objectCreator is designed to allow creating new objects (storage.objects.create) and may include listing objects, but it explicitly does not include storage.objects.get, which is the permission required to read the contents of existing objects. A VM with only this role would be unable to retrieve or view the data it needs to read, making it functionally incorrect for the stated requirement.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Compute Engine
Compute Engine is Google Cloud's Infrastructure-as-a-Service (IaaS) offering that lets you create and run virtual machines on Google's infrastructure.
Key term
IAM role
An IAM role is a set of permissions that an entity can assume temporarily to access cloud resources securely.
About these practice questions
One of 829 original GCDL practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.