A batch job running on Compute Engine needs temporary write access to a Cloud Storage bucket. You want the batch job to use the minimum permissions necessary to complete the task. What should you do?

The correct answer is C. Create a service account with the role. Use service account. Assigning the storage.objectCreator role grants the minimum necessary permissions (write/upload only), and service account impersonation allows temporary, controlled access for the batch job without exposing long-lived credentials.

Submitted by yaw92· Apr 18, 2026Configuring access within a cloud solution environment

Question

A batch job running on Compute Engine needs temporary write access to a Cloud Storage bucket. You want the batch job to use the minimum permissions necessary to complete the task. What should you do?

Options

ACreate a service account with full Cloud Storage administrator permissions. Assign the service
BCreate a service account and embed a long-lived service account key file that has write
CCreate a service account with the role. Use service account
DGrant the predefined storage.objectCreator role to the Compute Engine instance's default

How the community answered

(49 responses)

A
6% (3)
B
4% (2)
C
73% (36)
D
16% (8)

Explanation

Assigning the storage.objectCreator role grants the minimum necessary permissions (write/upload only), and service account impersonation allows temporary, controlled access for the batch job without exposing long-lived credentials.

Topics

#Service Accounts#IAM Roles#Least Privilege Principle#Cloud Storage Permissions

Community Discussion

No community discussion yet for this question.

Full PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice