PDE Practice Question: A user named Charlie needs to deploy a model to a…

Exhibit

Refer to the exhibit.

{
  "policy": {
    "bindings": [
      {
        "role": "roles/aiplatform.user",
        "members": [
          "user:alice@example.com"
        ]
      },
      {
        "role": "roles/aiplatform.modelUser",
        "members": [
          "user:bob@example.com"
        ]
      }
    ]
  }
}

This IAM policy is applied at the project level. Alice can create models but cannot get predictions from existing models. Bob can only get predictions but cannot create new models.

A user named Charlie needs to deploy a model to a Vertex AI Endpoint and also create training jobs. Which role should be assigned to Charlie?

⚠ Common exam trap

Test-takers frequently confuse `roles/aiplatform.user` with `roles/aiplatform.modelUser`, mistakenly thinking the latter is sufficient for creating training jobs, when in fact it only allows prediction on existing models.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

roles/aiplatform.user

Charlie needs to deploy a model to a Vertex AI Endpoint and create training jobs. The `roles/aiplatform.user` role grants the necessary permissions to use all Vertex AI resources, including creating and managing endpoints, training jobs, models, and predictions. This role is the minimum required for a user to interact with Vertex AI services without granting broader project-level permissions.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
roles/aiplatform.user
Why this is correct
roles/aiplatform.user grants permissions to create and manage training jobs and deploy models to Vertex AI Endpoints, covering both tasks Charlie needs. It provides the necessary platform-level access without granting broader administrative rights, satisfying the deployment and training job requirement.
✗
roles/owner
Why it's wrong here
roles/owner includes IAM administration and billing control, far exceeding the Vertex AI training and deployment permissions Charlie needs. It is tempting because it guarantees access to everything, and would be correct for a project owner responsible for managing access and lifecycle, not a model deployer.
✗
roles/aiplatform.modelUser
Why it's wrong here
roles/aiplatform.modelUser permits deploying and using models but omits the aiplatform.trainingJobs.create permission, so Charlie could not create training jobs. It is tempting because it covers the deployment half of the requirement, and would be correct for a user who only deploys and serves models.
✗
roles/editor
Why it's wrong here
roles/editor grants broad modify access across most Google Cloud services, breaching least privilege for a task needing only Vertex AI training and endpoint deployment. It is tempting as a quick catch-all, and would be correct for a developer requiring write access spanning many unrelated services.

Go deeper

PDE Practice Question: A user named Charlie needs to deploy a model to a…

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question