Google PCA Practice Question: Managing and Provisioning a Solution Infrastructure
A company wants to grant a service account in Project A the ability to push containers to Artifact Registry in Project B. They want to follow the principle of least privilege. Which IAM roles should they assign?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Grant the service account the Artifact Registry Writer role (roles/artifactregistry.writer) on the repository in Project B
To push containers, the service account needs the Artifact Registry Writer role (roles/artifactregistry.writer) on the repository in Project B. The Storage Object Admin role is too broad. The Artifact Registry Admin role is overly permissive. The Viewer role only allows reading.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Grant the service account the Storage Object Admin role (roles/storage.objectAdmin) on Project B
Why it's wrong here
Storage Object Admin is for Cloud Storage buckets, not Artifact Registry repositories. It grants too many permissions.
- ✓
Grant the service account the Artifact Registry Writer role (roles/artifactregistry.writer) on the repository in Project B
Why this is correct
Writer role allows pushing images and is the correct least-privilege role for this task.
- ✗
Grant the service account the Artifact Registry Admin role (roles/artifactregistry.admin) on the repository in Project B
Why it's wrong here
Admin role is too broad; it includes delete and manage permissions beyond just pushing.
- ✗
Grant the service account the Artifact Registry Reader role (roles/artifactregistry.reader) on the repository in Project B
Why it's wrong here
Reader role only allows pulling images, not pushing.
Go deeper
Related to this question
Learn chapter
Cloud Storage: Objects and Buckets
Key term
Service
A service is a software component or system that performs a specific function and is available to be used by other programs or users over a network.
Key term
Service account
A service account is a special type of account used by an application or a virtual machine, rather than a human user, to authenticate and interact with cloud services and APIs securely.
About these practice questions
Courseiva writes every PCA question from scratch — 955 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.