PCSE Practice Question: Configuring Access Within a Cloud Solution Environment
A security engineer is configuring access for a new team member who needs to manage Cloud Storage buckets, but should not be able to delete or modify existing objects. Which IAM role should be assigned?
⚠ Common exam trap
The PCSE exam often tests the distinction between bucket-level and object-level roles, and the trap here is that candidates confuse 'bucket writer' with 'object writer,' assuming it allows object modification, when in fact it only affects bucket metadata and not the objects themselves.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Storage Legacy Bucket Writer (roles/storage.legacyBucketWriter)
The Storage Legacy Bucket Writer role (roles/storage.legacyBucketWriter) allows a user to list, create, and update buckets, but it does not grant permissions to delete or modify existing objects within those buckets. This role is specifically designed for managing bucket-level metadata while restricting object-level write and delete operations, making it the correct choice for the described requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Storage Legacy Bucket Writer (roles/storage.legacyBucketWriter)
Why this is correct
Storage Legacy Bucket Writer (roles/storage.legacyBucketWriter) allows users to list, create, and update buckets, and list objects within buckets. However, it does not grant permissions to create, modify, or delete objects. Therefore, it satisfies the requirement of managing buckets without being able to delete or modify existing objects.
- ✗
Storage Object Viewer (roles/storage.objectViewer)
Why it's wrong here
Storage Object Viewer (roles/storage.objectViewer) provides read-only access to objects and their metadata, but does not allow any bucket management. It would not allow the team member to manage buckets.
- ✗
Storage Admin (roles/storage.admin)
Why it's wrong here
Storage Admin (roles/storage.admin) provides full control over buckets and objects, including deletion and modification, which is too permissive.
- ✗
Storage Object Admin (roles/storage.objectAdmin)
Why it's wrong here
Storage Object Admin (roles/storage.objectAdmin) allows full control over objects (create, delete, modify) but not bucket-level operations. This also does not meet the requirement of managing buckets without object modification.
Go deeper
Related to this question
About these practice questions
This PCSE question is part of Courseiva's 960-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.