Crucial Exams

GCP Associate Cloud Engineer Practice Question

Your Dataflow pipeline runs under a user-managed service account called df-sa@example-project. The job must write its results to a Cloud Storage bucket named analytics-output. You already granted your team the Service Account User (roles/iam.serviceAccountUser) role on df-sa, but the pipeline still fails with "403 permission denied" when it tries to upload objects to the bucket. What IAM change will let the job succeed while following the principle of least privilege?

  • Bind the Dataflow worker default service account to roles/iam.serviceAccountUser on df-sa@example-project.

  • Give df-sa@example-project the Storage Object Admin role (roles/storage.objectAdmin) at the project level.

  • Add an IAM policy binding that grants df-sa@example-project the Storage Object Creator role (roles/storage.objectCreator) on the analytics-output bucket.

  • Grant the Storage Object Creator role on df-sa@example-project so that any principal using the account can create objects.

GCP Associate Cloud Engineer
Configuring access and security
Your Score:
Settings & Objectives
Random Mixed
Questions are selected randomly from all chosen topics, with a preference for those you haven’t seen before. You may see several questions from the same objective or domain in a row.
Rotate by Objective
Questions cycle through each objective or domain in turn, helping you avoid long streaks of questions from the same area. You may see some repeat questions, but the distribution will be more balanced across topics.

Check or uncheck an objective to set which questions you will receive.

Wipe Score
Bash, the Crucial Exams Chat Bot
AI Bot