Unlock the power of your data in the cloud! Get hands-on with Google Cloud's core data services like BigQuery and Looker to validate your practical skills in data ingestion, analysis, and management, and earn your Associate Data Practitioner certification!
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
A data engineering team wants to allow a new team member to upload raw data files to a Google Cloud Storage bucket. Following the principle of least privilege, the team wants to ensure the user receives only the specific capability to write objects (such as storage.objects.create), without gaining unnecessary administrative control or wide access across the entire project.
Which statement accurately describes how Google Cloud IAM structures permissions and roles to fulfill this access requirement?
Individual permissions are attached directly to the user identity in an IAM policy, while roles are used solely to organize users into administrative groups.
Predefined roles automatically include all permissions for all Google Cloud services, requiring an explicit IAM deny policy to isolate specific actions.
Individual permissions cannot be granted directly to principals; instead, permissions are bundled into predefined or custom roles that are assigned to the principal.
Basic roles like Editor or Owner must be granted at the project level because granular object permissions cannot be isolated into service-specific roles.
Individual permissions are attached directly to the user identity in an IAM policy, while roles are used solely to organize users into administrative groups.
Predefined roles automatically include all permissions for all Google Cloud services, requiring an explicit IAM deny policy to isolate specific actions.
Individual permissions cannot be granted directly to principals; instead, permissions are bundled into predefined or custom roles that are assigned to the principal.
In Google Cloud Identity and Access Management (IAM), permissions are the fundamental, granular units of access that define discrete actions allowed on a resource (for example, storage.objects.create or storage.buckets.list). Roles are organized collections or bundles of one or more permissions designed to represent specific operational responsibilities.
StudyCerts
StudyCertsroles/storage.objectCreator) or build a custom role containing only the necessary permissions and bind it at the bucket level.Understanding that permissions exist as the underlying mechanism packaged within roles is foundational in Google Cloud. It ensures administrators use tailored predefined or custom roles at the correct resource hierarchy level rather than defaulting to overly broad basic roles.
Basic roles like Editor or Owner must be granted at the project level because granular object permissions cannot be isolated into service-specific roles.