nerdexam
Google

ASSOCIATE-CLOUD-ENGINEER · Question #178

An application generates daily reports in a Compute Engine virtual machine (VM). The VM is in the project corp-iot-insights. Your team operates only in the project corp-aggregate-reports and needs a c

The correct answer is B. Grant the VM Service Account the role Storage Object Creator on corp-aggregate-reports-. Predefined roles The following table describes Identity and Access Management (IAM) roles that are associated with Cloud Storage and lists the permissions that are contained in each role. Unless otherwise noted, these roles can be applied either to entire projects or specific buc

Submitted by cyberguy42· Mar 30, 2026Configuring access and security

Question

An application generates daily reports in a Compute Engine virtual machine (VM). The VM is in the project corp-iot-insights. Your team operates only in the project corp-aggregate-reports and needs a copy of the daily exports in the bucket corp-aggregate-reports-storage. You want to configure access so that the daily reports from the VM are available in the bucket corp-aggregate- reports-storage and use as few steps as possible while following Google-recommended practices. What should you do?

Options

  • AMove both projects under the same folder.
  • BGrant the VM Service Account the role Storage Object Creator on corp-aggregate-reports-
  • CCreate a Shared VPC network between both projects.
  • DMake corp-aggregate-reports-storage public and create a folder with a pseudo-randomized suffix

How the community answered

(28 responses)
  • A
    4% (1)
  • B
    86% (24)
  • C
    7% (2)
  • D
    4% (1)

Explanation

Predefined roles The following table describes Identity and Access Management (IAM) roles that are associated with Cloud Storage and lists the permissions that are contained in each role. Unless otherwise noted, these roles can be applied either to entire projects or specific buckets. Storage Object Creator (roles/storage.objectCreator) Allows users to create objects. Does not give permission to view, delete, or overwrite objects. https://cloud.google.com/storage/docs/access-control/iam-roles#standard-roles

Topics

#service account permissions#cross-project storage access#Storage Object Creator#least privilege

Community Discussion

No community discussion yet for this question.

Full ASSOCIATE-CLOUD-ENGINEER Practice