PCSE Practice Question: Configuring Access Within a Cloud Solution Environment
A security administrator needs to grant a team of developers the ability to deploy applications to a GKE cluster, but only to specific namespaces. The developers should not be able to modify cluster-level resources or IAM policies. Which three steps should the administrator take? (Choose THREE.)
⚠ Common exam trap
Watch out — candidates often confuse the project-level IAM roles (like roles/container.developer) with Kubernetes RBAC roles, assuming one is sufficient for namespace-scoped access, but both are required: IAM for cluster access and RBAC for namespace-level permissions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Kubernetes Role in the namespace with permissions to create and manage pods and services.
A Kubernetes Role defines permissions within a specific namespace, and granting permissions to create and manage pods and services aligns with the requirement to deploy applications without cluster-level access. This ensures developers can only interact with resources in the designated namespace, adhering to the principle of least privilege.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a Kubernetes Role in the namespace with permissions to create and manage pods and services.
Why this is correct
Namespace-scoped role for developers.
- ✓
Grant the developers the Kubernetes Engine Developer role (roles/container.developer) at the project level.
Why this is correct
Gives them permission to get cluster credentials and access resources, while RBAC restricts namespace.
- ✗
Create a ClusterRole and ClusterRoleBinding for the namespace.
Why it's wrong here
ClusterRole is cluster-scoped; Role is appropriate for namespace.
- ✗
Grant the developers the Kubernetes Engine Cluster Viewer role (roles/container.clusterViewer) at the project level.
Why it's wrong here
This is read-only; they need more permissions to deploy.
- ✓
Create a RoleBinding in the namespace that binds the developers' group to the Role.
Why this is correct
Binds the role to the group.
Go deeper
Related to this question
About these practice questions
One of 960 original PCSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.