nerdexam
Google

ASSOCIATE-CLOUD-ENGINEER · Question #33

While working on a project, an application administrator has been given the responsibility of managing all resources. He wants to delegate the responsibility of managing the existing service accounts

The correct answer is A. Granting iam.serviceAccountUser to the administrator at the project level. The task is to delegate the responsibility of managing all current and future service accounts within a project to another administrator.

Submitted by the_admin· Mar 30, 2026Configuring access and security

Question

While working on a project, an application administrator has been given the responsibility of managing all resources. He wants to delegate the responsibility of managing the existing service accounts to another administrator. He will also be responsible to manage the other service accounts that will be created. Which of the following is the best way to delegate the privileges required to manage all the service accounts?

Options

  • AGranting iam.serviceAccountUser to the administrator at the project level
  • BGranting iam.serviceProjectAccountUser to the administrator at the project level
  • CGranting iam.serviceAccountUser to the administrator at the service account level
  • DGranting iam.serviceProjectAccountUser to the administrator at the service account level

How the community answered

(31 responses)
  • A
    58% (18)
  • B
    6% (2)
  • C
    13% (4)
  • D
    23% (7)

Why each option

The task is to delegate the responsibility of managing all current and future service accounts within a project to another administrator.

AGranting iam.serviceAccountUser to the administrator at the project levelCorrect

Granting the `roles/iam.serviceAccountUser` role at the project level provides the ability to use or impersonate any service account within that project, which is required for broad management duties involving service account utilization for all existing and future service accounts.

BGranting iam.serviceProjectAccountUser to the administrator at the project level

The role `iam.serviceProjectAccountUser` is not a standard, predefined Google Cloud IAM role, making this option invalid.

CGranting iam.serviceAccountUser to the administrator at the service account level

Granting `iam.serviceAccountUser` at the service account level would only allow management of that specific service account, not all existing and future ones within the project.

DGranting iam.serviceProjectAccountUser to the administrator at the service account level

The role `iam.serviceProjectAccountUser` is not a standard, predefined Google Cloud IAM role, making this option invalid.

Concept tested: GCP IAM roles for service account management scope

Source: https://cloud.google.com/iam/docs/understanding-service-accounts#service_account_roles

Topics

#IAM#service accounts#role binding scope#project-level vs resource-level

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full ASSOCIATE-CLOUD-ENGINEER Practice