Google PCA Designing for Security and Compliance Practice Question
A developer needs to grant a Compute Engine instance the ability to read from a Cloud Storage bucket. The instance does not have a service account attached. What should the developer do?
⚠ Common exam trap
PCA often tests whether candidates confuse network-level controls (firewall rules, external IPs) with IAM authorization, or recommend insecure JSON keys instead of attaching a service account.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a service account and assign it the Storage Object Viewer role, then attach the service account to the instance.
A Compute Engine instance must have a service account attached to obtain Google Cloud credentials for API calls. The developer should create a service account, grant it the Storage Object Viewer role (or a custom role with storage.objects.get/list), and attach it to the instance. The instance can then use the metadata server to obtain short-lived tokens and read the bucket.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a service account and assign it the Storage Object Viewer role, then attach the service account to the instance.
Why this is correct
A service account supplies the identity the instance lacks; granting it roles/storage.objectViewer authorises reads from the bucket, and attaching it to the instance lets applications obtain credentials automatically via the metadata server. Without an attached service account, no workload identity exists to authorise the request.
- ✗
Add the instance's external IP to the bucket permissions.
Why it's wrong here
Bucket permissions are granted to IAM identities, not IP addresses, so adding an external IP grants nothing and would expose the bucket if attempted via public access. It is tempting as a network-style allowlist, but Cloud Storage authorisation requires an IAM principal, meaning a service account attached to the instance.
- ✗
Generate a JSON key for a user account and store it on the instance.
Why it's wrong here
Downloading a user-account JSON key creates a long-lived credential tied to a person, defeating the instance-level identity model and risking key leakage. It is tempting because keys work without a service account, but the correct approach is attaching a service account with a storage-read role to the instance.
- ✗
Create a firewall rule to allow access to Cloud Storage.
Why it's wrong here
Firewall rules govern network traffic to and from the instance's VPC; they never grant Cloud Storage IAM permissions, and the API is reached over Google's network anyway. It is tempting because connectivity failures resemble permission errors, but the fix is attaching a service account with a storage-read role.
Go deeper
Related to this question
Learn chapter
Cloud Storage: Objects and Buckets
Key term
CAN
A CAN (Controller Area Network) is a robust vehicle bus standard designed to allow microcontrollers and devices to communicate with each other without a host computer.
Key term
Metadata server
A metadata server is a network-accessible service that provides configuration data, credentials, and instance-specific information to virtual machines running in a cloud environment like Google Cloud Platform.
About these practice questions
This PCA question is part of Courseiva's 807-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Google Cloud exam blueprint
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.