GCP Associate Cloud Engineer Practice Question

Your company is moving workloads to Google Cloud. The operations group needs permission to start and stop Compute Engine instances and to view Cloud Logging entries. The security team insists that the granted role must not include permissions for unrelated services, and that any new relevant permissions should be added automatically by Google. Which IAM role approach should you take?

Create and assign a single custom role that lists only the start/stop instance and logging read permissions you need.
Grant the Service Account User role so team members can act as the default Compute Engine service account.
Grant the team Google-managed predefined roles that cover Compute Engine instance administration and log viewing.
Grant the basic Editor role at the project level so all required permissions are inherited.

Report Issue

Answer Description

Google-managed predefined roles such as roles/compute.instanceAdmin.v1 and roles/logging.viewer are maintained by Google and automatically receive any new permissions relevant to their services. They restrict access to Compute Engine instance administration and log viewing without granting broader project-wide privileges, meeting least-privilege and maintenance requirements.

Granting the basic Editor role would violate least privilege because it includes thousands of permissions across many services, even though it does not allow changing IAM policies. Creating a custom role would avoid excess permissions but would require manual updates whenever Google adds new permissions to Compute Engine or Cloud Logging. The Service Account User role only lets principals act as (or attach) a service account; it does not grant the ability to start instances or view logs.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.