PCSE Practice Question: Configuring Access Within a Cloud Solution Environment
A company wants to allow an external auditor to view all IAM policies in a project but not modify them. The auditor's Google account is from a different domain. Which IAM role should be assigned?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
roles/iam.securityReviewer
The roles/iam.securityReviewer role grants permission to view IAM policies and other security settings without write access. roles/viewer does not include iam.roles.list or iam.policies.get. roles/iam.roleViewer only lists roles, not policies. roles/securityAdmin includes write permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
roles/iam.roleViewer
Why it's wrong here
This role only lists roles, not IAM policies.
- ✗
roles/viewer
Why it's wrong here
Viewer does not include IAM policy read permissions.
- ✓
roles/iam.securityReviewer
Why this is correct
Correct: allows viewing IAM policies and security settings.
- ✗
roles/securityAdmin
Why it's wrong here
Includes write permissions, too broad.
Go deeper
Related to this question
About these practice questions
One of 960 original PCSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.