hardMultiple ChoiceObjective-mapped
PMLE Practice Question: A machine learning engineer needs to share a…
A machine learning engineer needs to share a trained model with the product team for integration. The model is stored in Cloud Storage, and the product team’s service account needs read access. The engineer wants to follow the principle of least privilege. Which IAM configuration should be used?
⚠ Common exam trap
Many exam-takers confuse the principle of least privilege with convenience, choosing a signed URL (Option A) because it seems simple, or selecting a project-level role (Option D) without realizing it grants access to all buckets, both of which violate the core requirement of minimal necessary permissions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Grant the product team's service account the roles/storage.objectViewer role at the bucket level.
Granting the product team's service account the roles/storage.objectViewer role at the bucket level provides read-only access to objects in that specific bucket, adhering to the principle of least privilege. This role allows the service account to list and read objects without granting broader permissions, such as modifying or deleting them, and scoping it to the bucket prevents unnecessary access to other buckets in the project.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Generate a signed URL with read access and share it with the product team.
Why it's wrong here
Signed URLs do not require IAM but may expire and are less secure for ongoing access.
- ✓
Grant the product team's service account the roles/storage.objectViewer role at the bucket level.
Why this is correct
Bucket-level grants read access to objects in that bucket only, following least privilege.
- ✗
Grant the product team's service account the roles/storage.objectAdmin role at the bucket level.
Why it's wrong here
Grants write/delete permissions, not least privilege.
- ✗
Grant the product team's service account the roles/storage.objectViewer role at the project level.
Why it's wrong here
Project-level grants access to all buckets in the project.
Go deeper
Related to this question
About these practice questions
One of 990 original PMLE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PMLE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PMLE exam.