GCP Associate Cloud Engineer Practice Question

A development project is linked to an active billing account, but creating a Compute Engine VM fails with the message "compute.googleapis.com API is not enabled for this project." The project editor role is considered too broad, and you need to grant the minimum additional permissions so the DevOps team can enable only the required APIs through either the console or the command 'gcloud services enable compute.googleapis.com'. Which IAM role should you grant to the DevOps group to meet the requirement while following the principle of least privilege?

Grant the predefined role roles/editor to the DevOps group.
Grant the predefined role roles/owner to the DevOps group.
Grant the predefined role roles/serviceusage.serviceUsageAdmin to the DevOps group.
Grant the predefined role roles/compute.admin to the DevOps group.

Report Issue

Answer Description

Enabling or disabling a Google Cloud API requires the permission serviceusage.services.enable, which is included in the predefined role roles/serviceusage.serviceUsageAdmin. This role lets principals manage the Service Usage API for a project without broader project-level privileges.

roles/editor contains the needed permission but also many unrelated permissions, violating least-privilege guidelines.
roles/owner grants full control of the project, far exceeding what is required.
roles/compute.admin (roles/compute.admin is actually roles/compute.admin or compute.admin?) provides permissions for managing Compute Engine resources but does not include serviceusage.services.enable, so it cannot turn on the API.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.