Cloud Digital Leader Practice Question: Google Cloud products, services, and solutions
Network Topology
Refer to the exhibit. A user receives this error when trying to SSH into a Compute Engine instance. Which IAM role should be granted to the user?
⚠ Common exam trap
Google Cloud often tests the misconception that `roles/compute.osLogin` is required for SSH access, but the trap here is that OS Login is an alternative method that must be explicitly enabled on the instance and project, whereas the default SSH access relies on metadata-based keys, which require `roles/compute.instanceAdmin.v1` to modify.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
roles/compute.instanceAdmin.v1
The error indicates the user lacks SSH access to the Compute Engine instance. The `roles/compute.instanceAdmin.v1` role includes the `compute.instances.setMetadata` permission, which allows the user to add their SSH public key to the instance's metadata, enabling SSH access. This role also provides broader instance management capabilities, making it the correct choice for resolving SSH connectivity issues.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
roles/compute.osLogin
Why it's wrong here
roles/compute.osLogin is insufficient because it only manages SSH key-based login via OS Login, not the underlying Compute Engine API permissions. The gcloud compute ssh command first calls compute.instances.get to fetch instance metadata; without this permission, the request fails before OS Login is ever consulted, so the role cannot resolve the error.
- ✓
roles/compute.instanceAdmin.v1
Why this is correct
roles/compute.instanceAdmin.v1 is the correct role because it grants compute.instances.get, which lets the user retrieve instance metadata required for SSH connection, and compute.instances.setMetadata, which allows updating SSH keys or enabling OS Login. This is the minimum privilege that includes the necessary API calls for ssh to succeed.
- ✗
roles/iam.serviceAccountUser
Why it's wrong here
roles/iam.serviceAccountUser is unrelated to SSH access; it only grants permission to act as a service account for a resource or instance, enabling use of the service account's credentials. It does not include compute.instances.get, so the user would still lack the foundational permission to view instance metadata and thus cannot SSH.
- ✗
roles/compute.admin
Why it's wrong here
roles/compute.admin does contain compute.instances.get and setMetadata, so it would technically allow SSH, but it grants full administrative control over all Compute Engine resources, including creating, deleting, and modifying instances and networks. This violates the principle of least privilege and is far broader than necessary for simply accessing an instance via SSH, so it is not the recommended role.
Visual reference
Go deeper
Related to this question
Learn chapter
Compute Options on Google Cloud
Key term
Metadata
Metadata is data that describes other data, providing context such as when a file was created, who created it, or its size.
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
About these practice questions
Courseiva writes every GCDL question from scratch — 829 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.