Google PCA Design for security and compliance Practice Question
A company wants to ensure that only Compute Engine instances with a specific service account can access a Cloud Storage bucket. Which IAM condition should they use?
⚠ Common exam trap
A common mix-up: candidates confuse the caller's service account (`iam.serviceAccount`) with the resource's service account (`resource.serviceAccount`), leading candidates to pick Option C, which would incorrectly check the service account attached to the Cloud Storage bucket (which does not exist) instead of the requesting instance's identity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Condition: 'iam.serviceAccount == "sa@project.iam.gserviceaccount.com"'
The `iam.serviceAccount` condition attribute in IAM conditions allows you to restrict access based on the service account identity of the caller. When a Compute Engine instance uses a service account, the condition `iam.serviceAccount == "sa@project.iam.gserviceaccount.com"` ensures that only requests authenticated with that specific service account are allowed to access the Cloud Storage bucket. This is the standard IAM condition attribute for matching the service account of the requesting principal.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Condition: 'request.auth == "serviceAccount:sa@project.iam.gserviceaccount.com"'
Why it's wrong here
This is not a valid IAM condition syntax.
- ✗
Condition: 'origin.serviceAccount == "sa@project.iam.gserviceaccount.com"'
Why it's wrong here
'origin' is used for VPC network origins, not service accounts.
- ✗
Condition: 'resource.serviceAccount == "sa@project.iam.gserviceaccount.com"'
Why it's wrong here
The correct attribute is 'iam.serviceAccount', not 'resource.serviceAccount'.
- ✓
Condition: 'iam.serviceAccount == "sa@project.iam.gserviceaccount.com"'
Why this is correct
The condition 'iam.serviceAccount' matches the service account used by the caller.
Go deeper
Related to this question
Learn chapter
Introduction to Google Cloud Platform
Key term
CAN
A CAN (Controller Area Network) is a robust vehicle bus standard designed to allow microcontrollers and devices to communicate with each other without a host computer.
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
About these practice questions
Courseiva writes every PCA question from scratch — 955 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.