Google PCA Design and plan a cloud solution architecture Practice Question

Exhibit

Refer to the exhibit.

{
  "bindings": [
    {
      "role": "roles/storage.objectViewer",
      "members": [
        "user:admin@example.com"
      ]
    },
    {
      "role": "roles/storage.objectAdmin",
      "members": [
        "serviceAccount:my-sa@project.iam.gserviceaccount.com"
      ]
    }
  ]
}

The exhibit shows a Cloud Storage bucket IAM policy. A developer (admin@example.com) wants to upload a file to the bucket but gets a permission denied error. What is the most likely reason?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The developer is assigned only the objectViewer role

The correct answer is D: the developer is assigned only the objectViewer role. The objectViewer role (roles/storage.objectViewer) grants read-only access to objects, including listing and downloading, but it does not include storage.objects.create, so any upload attempt will fail with a permission denied error. Options A and B are unlikely because an organization policy denying all writes or project non-membership would typically produce broader failures or different errors, and there is no evidence in the scenario. Option C is incorrect because IAM permissions are additive; a service account's permissions do not override or reduce a user's granted roles, so my-sa cannot strip the developer's access.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
An organization policy denies all write operations
Why it's wrong here
No evidence of org policy.
✗
The developer is not a member of the project
Why it's wrong here
Project membership is not required to access a bucket; bucket-level IAM bindings grant access independently of project roles. Project membership matters for project-wide permissions, but the denial stems from the bucket policy's actual bindings, which the exhibit shows omitting this developer.
✗
The service account my-sa overrides the developer's permissions
Why it's wrong here
IAM is additive: no service account can subtract a principal's granted roles, so my-sa cannot override admin@example.com's permissions. The binding granting the developer storage.objects.create is simply absent from the bucket policy. Service account impersonation matters only when a workload authenticates as that account rather than as the developer.
✓
The developer is assigned only the objectViewer role
Why this is correct
The objectViewer role grants read-only access to objects, so it cannot authorise uploads. Uploading requires storage.objects.create, which objectViewer excludes. The permission denied error therefore stems from the developer lacking a write-capable role such as objectCreator or objectAdmin, matching the stem's upload constraint.

Go deeper

Google PCA Design and plan a cloud solution architecture Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question