PCSE Practice Question: Configuring Access Within a Cloud Solution Environment
A company wants to grant a group of external auditors read-only access to all resources in a GCP project. The auditors authenticate via a SAML 2.0 identity provider. What is the most secure way to grant access?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Cloud Identity group, add the auditors, and assign the Viewer role to the group at the project level.
Cloud Identity groups can be used to manage access. The auditors should be added to a Google Group, and that group is assigned the Viewer role at the project level. This avoids managing individual accounts. IAP is for application access, not project-level. Service accounts are for workloads. Custom roles are not needed for read-only.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a Cloud Identity group, add the auditors, and assign the Viewer role to the group at the project level.
Why this is correct
Group-based access is secure and scalable.
- ✗
Create a service account for each auditor and assign the Viewer role.
Why it's wrong here
Service accounts are for workloads, not human users.
- ✗
Use IAP to restrict access to the GCP console.
Why it's wrong here
IAP protects applications, not project-level access.
- ✗
Create a custom role with only list permissions and assign to each auditor individually.
Why it's wrong here
Assigning a custom role to each auditor individually creates an unmanageable administrative burden, failing to leverage the SAML 2.0 identity provider for scalable group-based access and user lifecycle management. This approach is not suitable for external groups. Custom roles are, however, excellent for enforcing the principle of least privilege, and individual assignments are appropriate for a small, static number of internal users or service accounts requiring unique, granular permissions.
Go deeper
Related to this question
About these practice questions
One of 960 original PCSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.