Google PCA Design for security and compliance Practice Question

Exhibit

Refer to the exhibit.

Cloud Audit Log entry:
```json
{
  "protoPayload": {
    "methodName": "v1.compute.firewalls.insert",
    "resourceName": "projects/my-project/global/firewalls/allow-ssh",
    "authenticationInfo": {
      "principalEmail": "admin@example.com"
    },
    "authorizationInfo": [
      {
        "permission": "compute.firewalls.create",
        "granted": false,
        "resourceAttributes": {
          "name": "projects/my-project/global/firewalls"
        }
      }
    ],
    "status": {
      "code": 7,
      "message": "Permission denied"
    }
  }
}
```

The firewall rule 'allow-ssh' was not created. According to the audit log, what is the most likely reason?

⚠ Common exam trap

Many candidates assume the `compute.securityAdmin` role does not include `compute.firewalls.create`, when in fact it does, leading them to incorrectly select Option B.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The user does not have the compute.firewalls.create permission.

The audit log indicates the firewall rule 'allow-ssh' was not created because the user lacks the specific permission required to create firewall rules in Google Cloud. The correct permission is `compute.firewalls.create`, which is part of the `compute.securityAdmin` role but not automatically granted with it; the `compute.securityAdmin` role includes `compute.firewalls.create`, so Option B is factually incorrect. The most likely reason is that the user does not have the `compute.firewalls.create` permission, which is a prerequisite for creating firewall rules.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The user is not authenticated.
Why it's wrong here
The log shows authenticationInfo with principalEmail.
✗
The user has the compute.securityAdmin role but not compute.firewalls.create.
Why it's wrong here
compute.securityAdmin does not include create permission.
✓
The user does not have the compute.firewalls.create permission.
Why this is correct
AuthorizationInfo shows granted: false for that permission.
✗
The firewall rule already exists and cannot be duplicated.
Why it's wrong here
The log shows a permission denied, not a conflict error.

Go deeper

Google PCA Design for security and compliance Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question