PCSE Practice Question: Configuring Access Within a Cloud Solution Environment
A security engineer is configuring access for a service account used by a batch job that runs on Compute Engine. The job needs to read from a BigQuery dataset and write results to Cloud Storage. What is the recommended way to grant these permissions?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a custom role with bigquery.datasets.get, bigquery.tables.get, bigquery.tables.getData, storage.objects.create, storage.objects.get, and storage.objects.list.
Create a custom role with the required BigQuery and Storage permissions, or use predefined roles: BigQuery Data Viewer (roles/bigquery.dataViewer) and Storage Object Admin (roles/storage.objectAdmin) for write access. The best practice is to use the principle of least privilege: grant only the necessary permissions. Predefined roles are acceptable if they match the needs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the default compute engine service account and grant it BigQuery Admin (roles/bigquery.admin) and Storage Admin (roles/storage.admin).
Why it's wrong here
Too permissive and uses default service account which is not recommended.
- ✓
Create a custom role with bigquery.datasets.get, bigquery.tables.get, bigquery.tables.getData, storage.objects.create, storage.objects.get, and storage.objects.list.
Why this is correct
This custom role follows least privilege, granting only read on BigQuery and write on Storage.
- ✗
Grant the service account the BigQuery Data Owner role (roles/bigquery.dataOwner) and Storage Admin (roles/storage.admin).
Why it's wrong here
These roles are overly permissive; BigQuery Data Owner allows data deletion, and Storage Admin allows bucket management and deletion.
- ✗
Grant the service account the BigQuery Data Viewer (roles/bigquery.dataViewer) and Storage Object Viewer (roles/storage.objectViewer).
Why it's wrong here
Storage Object Viewer does not allow writing objects.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCSE question from scratch — 960 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.