PCSE Practice Question: Configuring Access Within a Cloud Solution Environment
A developer wants to grant a Compute Engine instance access to read objects from a Cloud Storage bucket. The instance runs under a service account. What is the best practice for granting this access?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign the Storage Object Viewer role to the service account attached to the instance.
The best practice is to assign the appropriate IAM role (e.g., Storage Object Viewer) to the service account that the instance is running as. Then, the instance can use the service account's credentials automatically via the metadata server. This avoids the need to manage service account keys. Generating keys is discouraged. Allowing the instance to use the default compute engine service account is common but less secure; a custom service account with minimal permissions is preferred.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an IAM policy on the bucket that grants access to the instance's external IP address.
Why it's wrong here
IAM policies do not support granting access based on IP addresses; they are identity-based, not network-based.
- ✓
Assign the Storage Object Viewer role to the service account attached to the instance.
Why this is correct
This is the correct approach. The service account is authorized, and the instance can access the bucket using its metadata server credentials.
- ✗
Use a signed URL with a long expiration time for the instance.
Why it's wrong here
Signed URLs are for temporary, user-specific access, not for a service to programmatically read objects over time. They also require managing secrets.
- ✗
Generate a JSON key for the service account, download it to the instance, and use it in application code.
Why it's wrong here
Managing service account keys is a security risk and should be avoided. The instance can use the metadata server without keys.
Go deeper
Related to this question
About these practice questions
One of 960 original PCSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.