GCP Associate Cloud Engineer Practice Question

Google-managed predefined roles are designed for least-privilege access. Each predefined role bundles only the permissions needed for a specific product or job function (for example, roles/compute.instanceAdmin). Because Google owns these roles, it automatically updates them when services add or deprecate permissions, removing the administrative burden on customers.

Basic (primitive) roles like Editor are broad and grant thousands of permissions across an entire project, violating least-privilege guidelines. Custom roles allow fine-grained control but require you to curate and maintain the permission list yourself. "Service account role" is not an IAM role category; service accounts are principals, not roles.

Therefore, selecting a predefined role satisfies all the stated requirements.