Google PCA Manage implementation of cloud architecture Practice Question
A developer is using Cloud Build to automate deployments. The build fails with an error: 'Permission 'iam.serviceAccounts.actAs' denied.' What is the most likely cause?
⚠ Common exam trap
Google Cloud often tests the distinction between granting permissions to a user versus granting roles to a service account, and the trap here is that candidates mistakenly think the developer needs the `actAs` permission directly (Option A), when in fact it is the Cloud Build service account that requires the Service Account User role on the target service account.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Cloud Build service account does not have the Service Account User role on the service account used in the build steps
The error 'Permission iam.serviceAccounts.actAs denied' occurs when a Cloud Build build step tries to impersonate a service account (e.g., to deploy resources) but the Cloud Build service account lacks the Service Account User role on that target service account. Option D correctly identifies that the Cloud Build service account does not have the `roles/iam.serviceAccountUser` role on the service account used in the build steps, which is required to delegate access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The developer does not have iam.serviceAccounts.actAs permission on the project
Why it's wrong here
The builder service account lacks the permission, not the developer.
- ✗
The build configuration is missing a required step
Why it's wrong here
The error is about permissions, not configuration.
- ✗
The Cloud Build service account is not enabled
Why it's wrong here
Cloud Build service account is enabled by default; the error is about permission.
- ✓
The Cloud Build service account does not have the Service Account User role on the service account used in the build steps
Why this is correct
actAs permission is required for impersonation.
Go deeper
Related to this question
Learn chapter
Introduction to Google Cloud Platform
Key term
Cloud Build
Cloud Build is a managed service that compiles source code into deployable artifacts, often used in continuous integration and continuous delivery pipelines.
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
About these practice questions
This PCA question is part of Courseiva's 955-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.