PCSE Practice Question: Configuring Access Within a Cloud Solution Environment
A developer needs to deploy an application on Compute Engine that reads from a Cloud Storage bucket. The engineer wants to avoid managing service account keys. What is the recommended approach to grant the necessary permissions?
⚠ Common exam trap
Many candidates think the default Compute Engine service account is the simplest choice, but it often has excessive permissions (e.g., editor role) and is not recommended for production. The correct approach is to create a custom service account with minimal roles and attach it to the instance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a custom service account, grant it required roles, and attach it to the Compute Engine instance.
Attaching a custom service account directly to a Compute Engine instance is the recommended approach to avoid managing service account keys. This method uses the instance's metadata to provide credentials via the instance metadata server, eliminating the need to download, store, or rotate JSON key files. The custom service account can be granted only the required roles (e.g., Storage Object Viewer) following the principle of least privilege.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a service account, generate a JSON key, and store it on the instance.
Why it's wrong here
Using keys is discouraged; they can be leaked or rotated.
- ✗
Use the default Compute Engine service account and grant it the Storage Object Viewer role.
Why it's wrong here
Default service accounts are not recommended due to broad permissions. Using a custom service account is preferable.
- ✗
Use Application Default Credentials (ADC) without a service account.
Why it's wrong here
ADC requires a service account to be attached to the instance or a key file to be present.
- ✓
Create a custom service account, grant it required roles, and attach it to the Compute Engine instance.
Why this is correct
This follows the principle of least privilege and avoids key management.
Go deeper
Related to this question
About these practice questions
One of 960 original PCSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.