Google PCA Manage and provision cloud infrastructure Practice Question

Exhibit

Refer to the exhibit.
```
$ gsutil cp myfile.txt gs://my-bucket/
Copying file://myfile.txt [Content-Type=text/plain]...
AccessDeniedException: 403 Anonymous caller does not have storage.objects.create access to the Google Cloud Storage bucket.
```

A user runs the gsutil command shown in the exhibit and gets an AccessDenied error. The user is not authenticated with gcloud. What should the user do first?

⚠ Common exam trap

Google Cloud often tests the distinction between authentication (who you are) and authorization (what you can do); the trap here is that candidates may confuse the AccessDenied error with a bucket permission issue and jump to granting public access or setting a project, when the root cause is simply missing authentication credentials.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Run gcloud auth login to authenticate with their Google account.

The error occurs because the user is not authenticated with gcloud. The gsutil command requires valid authentication credentials to access Google Cloud Storage resources. Running `gcloud auth login` initiates the OAuth 2.0 flow, which authenticates the user with their Google account and generates the access token that gsutil uses for API calls. This is the prerequisite step before any gsutil operation can succeed.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Create a service account and download a JSON key.
Why it's wrong here
Creating a service account and JSON key is unnecessary overhead when the user simply needs to authenticate interactively; gcloud auth login would suffice. Service accounts suit automated, non-interactive workloads such as CI pipelines or applications, not a human running gsutil once. The stem's issue is absent user credentials.
✗
Grant public write access to the bucket.
Why it's wrong here
AccessDenied stems from the user lacking credentials, not bucket permissions; gsutil cannot authenticate without gcloud or a key. Granting public write access exposes the bucket to anyone and still leaves the user's identity unresolved. Public access suits deliberately shared datasets, not fixing an unauthenticated caller's own access.
✗
Use gcloud config set project my-project to set the project.
Why it's wrong here
Setting the project only changes which project gsutil targets; it supplies no credentials, so the unauthenticated request still fails. The project flag is for directing commands at the right resource when identity already exists. Here the missing piece is authentication, which config set project cannot provide.
✓
Run gcloud auth login to authenticate with their Google account.
Why this is correct
gsutil relies on credentials from gcloud authentication. Since the user is not authenticated, no access token exists, so the request fails with AccessDenied. Running gcloud auth login establishes the Google account credentials gsutil then uses, resolving the authentication failure before any permission check occurs.

Go deeper

Google PCA Manage and provision cloud infrastructure Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question