Google PCA Manage and provision cloud infrastructure Practice Question

Drag and drop the steps to configure IAM roles for a service account to access Cloud Storage from a Compute Engine instance into the correct order.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create the service account, then grant the necessary IAM roles, then attach the service account to the Compute Engine instance.

The service account must be attached to the instance before it can be used. Granting roles is done on the service account.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Create the service account, then grant the necessary IAM roles, then attach the service account to the Compute Engine instance.
Why this is correct
This is the correct order because you must first create the service account, then assign the required Cloud Storage permissions to it, and finally attach it to the instance so that the instance can use the service account's credentials.
✗
Grant the necessary IAM roles, then attach the service account to the Compute Engine instance, then create the service account.
Why it's wrong here
This is incorrect because you cannot grant roles to a service account that does not exist yet. The service account must be created before any roles can be assigned.
✗
Attach the service account to the Compute Engine instance, then create the service account, then grant the necessary IAM roles.
Why it's wrong here
This is incorrect because you cannot attach a non-existent service account to an instance. The service account must be created first, then roles assigned, then attached.
✗
Create the service account, then attach it to the Compute Engine instance, then grant the necessary IAM roles.
Why it's wrong here
This is incorrect because granting roles after attachment may cause a delay before the instance can use the permissions. Best practice is to grant roles before attaching the service account to ensure immediate access.

Go deeper