Cloud Digital Leader Fundamental Cloud Concepts Practice Question
A security administrator needs to grant a developer the minimum permissions to create and delete Cloud Storage buckets in a specific project, but NOT allow them to modify the contents of those buckets (e.g., upload or delete objects). Which IAM role should they assign?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Custom role with storage.buckets.* permissions
Storage Admin (roles/storage.admin) grants full control over buckets and objects, which is too permissive. The correct approach is to create a custom role with only storage.buckets.* permissions, or use predefined roles like Storage Object Admin? Actually, Storage Object Admin allows object management. The question requires bucket management only. A custom role with storage.buckets.create and storage.buckets.delete (and maybe storage.buckets.get) is necessary; predefined roles do not separate bucket and object permissions perfectly. But among standard roles, 'Storage Admin' is too broad; there is no predefined role that only allows bucket management without object access. So the answer must be a custom role.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Storage Admin (roles/storage.admin)
Why it's wrong here
Storage Admin (roles/storage.admin) grants full control over Cloud Storage, including the ability to create, delete, and manage buckets AND objects, along with the power to set IAM policies on buckets. This role far exceeds the developer's need to manage buckets only, as it also includes object-level operations like upload, download, and delete, exposing sensitive data and violating the principle of least privilege. A custom role limited to storage.buckets.* is more appropriate because it scopes permissions strictly to bucket lifecycle management without granting any access to object contents.
- ✗
Storage Object Admin (roles/storage.objectAdmin)
Why it's wrong here
Storage Object Admin (roles/storage.objectAdmin) is designed for managing objects within buckets, allowing actions like reading, writing, and deleting objects, but critically it does NOT include bucket-level operations such as storage.buckets.create or storage.buckets.delete. Since the developer needs to create and delete buckets, this predefined role is insufficient because it lacks those bucket-management permissions. It also grants object data access that is not required, making it both too narrow for the task and too broad in terms of data exposure. A custom role with storage.buckets.* permissions provides the exact bucket-scoped capabilities without any object access.
- ✓
Custom role with storage.buckets.* permissions
Why this is correct
A custom role with storage.buckets.* permissions is the correct choice because it allows you to define a precise set of bucket-level operations—such as storage.buckets.create, storage.buckets.get, storage.buckets.update, and storage.buckets.delete—while explicitly excluding all object-related permissions (e.g., storage.objects.*). This granularity enforces least privilege by ensuring the developer can manage the bucket lifecycle but cannot view, upload, or delete any objects stored within those buckets. Unlike predefined roles that couple bucket and object access, this custom role minimizes the attack surface and aligns with security best practices for infrastructure management.
- ✗
Project Editor (roles/editor)
Why it's wrong here
Project Editor (roles/editor) is a primitive role that grants broad, project-wide write permissions across virtually all Google Cloud services, including Compute Engine, Kubernetes, and Cloud Storage. For storage specifically, it allows full control over both buckets and objects, but it also lets the developer modify networking, security policies, and other critical infrastructure—far beyond the stated need. This role violates least privilege dramatically, as it would permit the developer to alter any resource in the project, not just manage storage buckets. The minimal custom role with storage.buckets.* is a safer, more scoped alternative that avoids giving accidental power over unrelated services.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Custom role
A custom role is a user-defined set of permissions in Google Cloud that you can tailor to fit specific job functions beyond the predefined roles.
Key term
IAM role
An IAM role is a set of permissions that an entity can assume temporarily to access cloud resources securely.
About these practice questions
Courseiva writes every GCDL question from scratch — 829 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.