Google PCA Manage implementation of cloud architecture Practice Question
Exhibit
Refer to the exhibit. error: googleapi: Error 403: The caller does not have permission, forbidden Stackdriver Logging logged: 'iam.serviceAccounts.actAs' permission on service account '12345-compute@developer.gserviceaccount.com'.
A developer is trying to deploy a Compute Engine instance from a Cloud Build step. The build fails with the above error. What is the problem?
⚠ Common exam trap
Google Cloud often tests the subtle distinction between having resource-level permissions (like 'compute.instances.create') and the 'actAs' permission required to impersonate a service account, leading candidates to incorrectly choose the missing resource permission.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Build does not have the 'iam.serviceAccounts.actAs' permission on the default compute service account.
The error occurs because Cloud Build needs to impersonate the Compute Engine default service account to create a VM instance. The Cloud Build service account requires the 'iam.serviceAccounts.actAs' permission on the target service account to delegate its identity. Without this permission, the build step fails even if the Cloud Build service account has 'compute.instances.create' permission.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The project has exceeded its service account quota.
Why it's wrong here
No quota error.
- ✗
The Cloud Build service account lacks 'compute.instances.create' permission.
Why it's wrong here
Error says actAs, not create.
- ✓
Cloud Build does not have the 'iam.serviceAccounts.actAs' permission on the default compute service account.
Why this is correct
When Cloud Build creates a VM, it must act as the VM's service account.
- ✗
The developer's personal account does not have permission to use Cloud Build.
Why it's wrong here
Error from Cloud Build service account.
Go deeper
Related to this question
Learn chapter
Introduction to Google Cloud Platform
Key term
Service
A service is a software component or system that performs a specific function and is available to be used by other programs or users over a network.
Key term
Cloud Build
Cloud Build is a managed service that compiles source code into deployable artifacts, often used in continuous integration and continuous delivery pipelines.
About these practice questions
One of 955 original PCA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.