Cloud Digital Leader Practice Question: Google Cloud products, services, and solutions
A developer needs to grant a service account the minimum permissions required to publish messages to a Pub/Sub topic. Which IAM role should they assign?
⚠ Common exam trap
Google Cloud often tests the distinction between publisher and subscriber roles, and the trap here is that candidates may confuse `roles/pubsub.publisher` with `roles/pubsub.subscriber` or assume a broad role like `roles/editor` is acceptable, overlooking the principle of least privilege.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
roles/pubsub.publisher
The `roles/pubsub.publisher` role grants the minimum permissions required to publish messages to a Pub/Sub topic. This role includes the `pubsub.topics.publish` permission, which allows a service account to send messages to a specific topic without granting any other unnecessary permissions like subscribing or managing the topic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
roles/editor
Why it's wrong here
roles/editor is a primitive role that grants broad permissions across many services, including pubsub.topics.publish and pubsub.topics.subscribe, but also allows creating/deleting topics and managing subscriptions. It exceeds the minimum because it includes many unrelated permissions and allows destructive actions, violating least privilege. Specifically, a subscriber who only needs to publish messages would also get rights to modify IAM policies on Pub/Sub resources, which is overkill.
- ✗
roles/pubsub.subscriber
Why it's wrong here
roles/pubsub.subscriber is a predefined role that allows receiving messages and managing subscriptions (e.g., subscriptions.consume, subscriptions.create), but it does not include the permission pubsub.topics.publish. It is designed for consumers, not producers, so a service account needing to publish would be denied when calling publish. The permission set is fundamentally different from publishing.
- ✓
roles/pubsub.publisher
Why this is correct
roles/pubsub.publisher is the correct predefined role because it contains only the permissions required to publish messages to a topic, primarily pubsub.topics.publish. It also includes pubsub.topics.get for metadata, but it does not grant any subscription management or administrative capabilities. This matches the principle of least privilege by providing exactly the needed actions and nothing more.
- ✗
roles/pubsub.admin
Why it's wrong here
roles/pubsub.admin is a predefined role that grants full control over all Pub/Sub resources, including creating/deleting topics, managing subscriptions, publishing and subscribing, and modifying IAM policies. While it includes pubsub.topics.publish, it also grants many destructive and administrative permissions far beyond the requirement, making it inappropriate for a minimum-permission grant.
Go deeper
Related to this question
Learn chapter
Private Service Connect and Private Access
Key term
Service account
A service account is a special type of account used by an application or a virtual machine, rather than a human user, to authenticate and interact with cloud services and APIs securely.
Key term
Pub/Sub
Pub/Sub is a messaging pattern where publishers send messages without knowing who receives them, and subscribers receive only the messages they care about.
About these practice questions
One of 829 original GCDL practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.