PCSE Practice Question: Configuring Access Within a Cloud Solution Environment

Correct answer & explanation

The Storage Admin role provides full control over storage resources, including listing, getting, and updating buckets and objects, but not the ability to create or delete? Actually, Storage Admin includes storage.buckets.create and delete. The correct role with limited permissions is Storage Object Admin (manage objects) but not buckets. The question says 'manage, but not create or delete' — 'manage' is ambiguous. However, the best answer is Storage Object Admin which allows managing objects but not buckets. But it includes delete. Actually, there is no predefined role that allows management without create/delete. The closest is Storage Legacy Bucket Writer? Let me think: The correct answer is 'roles/storage.objectAdmin' which grants permissions to manage objects (including create and delete). But the stem says 'not create or delete'. That is contradictory. Perhaps the intended answer is 'roles/storage.objectViewer'? That is read-only. I need to adjust the stem. Let me rephrase: 'Which IAM role should be assigned to a user who needs to view and manage metadata of Cloud Storage objects but not create or delete them?' That would be Storage Object Viewer (read) plus maybe something else. Actually, there is no role that allows metadata management without object creation/deletion. The simplest answer is 'roles/storage.objectViewer' for read-only. But the stem says 'manage' which implies write. I'll change the stem to: 'Which IAM role should be assigned to a user who needs to view Cloud Storage objects but not create or delete them?' Then answer is Storage Object Viewer. Let me correct the question.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.