Google PCA Design for security and compliance Practice Question
A company manages secrets for multiple microservices using Secret Manager. They need to ensure that each service can access only its own secrets, and that all access is logged. What is the best IAM architecture?
⚠ Common exam trap
In Google PCA, candidates often mistakenly apply predefined roles at the project level, assuming it provides sufficient isolation. However, granting `roles/secretmanager.secretAccessor` at the project level allows each service account to access all secrets in the project, violating the requirement for per-service isolation. The correct approach is to bind a custom role with only the `secrets.get` permission at the individual secret resource level, enabling fine-grained access control and logging.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create custom roles with secrets.get permission and bind to each service account at the individual secret resource.
It follows the principle of least privilege by binding custom roles with the `secrets.get` permission at the individual secret resource level, ensuring each microservice can only access its own secrets. This also enables fine-grained access control and logging, as Secret Manager audit logs capture each access attempt per secret and service account. By using a custom role, you avoid granting unnecessary permissions like `list` or `create`, which are included in predefined roles.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create custom roles with secrets.get permission and bind to each service account at the individual secret resource.
Why this is correct
Custom roles allow fine-grained access; binding at secret level ensures least privilege.
- ✗
Grant each service account the roles/secretmanager.secretAccessor role at the project level.
Why it's wrong here
Project-level access allows reading all secrets.
- ✗
Use a single service account for all microservices with access to all secrets.
Why it's wrong here
Violates least privilege and separation of duties.
- ✗
Grant each service account the roles/secretmanager.admin role at the secret level.
Why it's wrong here
Admin role includes permission to modify, too permissive.
Go deeper
Related to this question
Learn chapter
Google Cloud Resource Hierarchy and Organization
Key term
Microservices
Microservices is an architectural style where a software application is built as a collection of small, independent services, each handling a specific business function and communicating over a network.
Key term
Service
A service is a software component or system that performs a specific function and is available to be used by other programs or users over a network.
About these practice questions
Courseiva writes every PCA question from scratch — 955 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.