PCSE Practice Question: Configuring Access Within a Cloud Solution Environment
A development team needs to grant a third-party auditor read-only access to a specific project's resources but must not allow the auditor to view any data stored in Cloud Storage buckets. Which IAM approach should be used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a custom role that includes only the required read permissions except those for Cloud Storage.
Custom roles allow you to curate a specific set of permissions. You can create a role that includes read permissions for Compute Engine and Cloud SQL but excludes storage.objects.get on Cloud Storage. Predefined roles like Viewer include storage.objects.get, and basic roles are too broad. Condition-based access can be complex and error-prone.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign the predefined roles/viewer role and add a condition to deny access to Cloud Storage.
Why it's wrong here
Predefined roles cannot be easily restricted; conditions can deny but may be complex and less secure.
- ✗
Use a deny policy to block access to storage.objects.get for the auditor.
Why it's wrong here
Blocking `storage.objects.get` with a deny policy is insufficient because it only prevents direct retrieval of object data, not necessarily the listing of objects (`storage.objects.list`) or access to their metadata, which could still reveal information. Deny policies are powerful for creating security boundaries or exceptions, such as preventing a specific user from performing a particular action even if a broader role they possess would otherwise permit it. This approach is suitable when an existing, wider role *must* be assigned, but a specific permission within it needs to be explicitly overridden and blocked.
- ✗
Assign the basic roles/reader role to the auditor.
Why it's wrong here
Basic roles are broad and include storage read access.
- ✓
Create a custom role that includes only the required read permissions except those for Cloud Storage.
Why this is correct
Custom roles allow exact permission selection, excluding storage read permissions.
Go deeper
Related to this question
About these practice questions
One of 960 original PCSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.