PCSE Practice Question: Configuring Access Within a Cloud Solution Environment
A security engineer notices that a service account has been assigned the roles/iam.serviceAccountUser role at the project level. What actions can a user with this role perform?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Impersonate the service account to access resources.
The roles/iam.serviceAccountUser role allows a user to impersonate a service account (via gcloud or API) and use its permissions to access resources. It does not allow creating, deleting, or viewing keys of service accounts. This aligns with the requirement that the team should not be able to delete the service, as the role lacks deletion permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create new service accounts in the project.
Why it's wrong here
Creating new service accounts requires the roles/iam.serviceAccountAdmin role, not roles/iam.serviceAccountUser.
- ✓
Impersonate the service account to access resources.
Why this is correct
Correct. The roles/iam.serviceAccountUser role specifically grants permission to impersonate a service account and use its permissions.
- ✗
Delete the service account.
Why it's wrong here
Deleting a service account is not allowed by roles/iam.serviceAccountUser; it requires roles/iam.serviceAccountAdmin or higher.
- ✗
View the service account's keys.
Why it's wrong here
Viewing service account keys is not granted by roles/iam.serviceAccountUser; it requires roles/iam.serviceAccountKeyAdmin or similar.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCSE question from scratch — 960 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.