Google
ASSOCIATE-CLOUD-ENGINEER · Question #292
The DevOps group in your organization needs full control of Compute Engine resources in your development project. However, they should not have permission to create or update any other resources in th
The correct answer is A. Grant the basic role roles/viewer and the predefined role roles/compute.admin to the DevOps. roles/viewer gives read only access on Project, so it does not create/update any resources. roles/compute.admin gives full access to Compute Engine resources.
Submitted by wei.xz· Mar 30, 2026Configuring access and security
Question
The DevOps group in your organization needs full control of Compute Engine resources in your development project. However, they should not have permission to create or update any other resources in the project. You want to follow Google's recommendations for setting permissions for the DevOps group. What should you do?
Options
- AGrant the basic role roles/viewer and the predefined role roles/compute.admin to the DevOps
- BCreate an IAM policy and grant all compute.instanceAdmin.* permissions to the policy. Attach the
- CCreate a custom role at the folder level and grant all compute.instanceAdmin.* permissions to the
- DGrant the basic role roles/editor to the DevOps group.
How the community answered
(50 responses)- A72% (36)
- B16% (8)
- C4% (2)
- D8% (4)
Explanation
roles/viewer gives read only access on Project, so it does not create/update any resources. roles/compute.admin gives full access to Compute Engine resources.
Topics
#IAM roles#compute.admin#least privilege#predefined roles
Community Discussion
No community discussion yet for this question.