Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Google Professional Cloud Developer Exam - Topic 4 Question 119 Discussion

You have an application written in Python running in production on Cloud Run. Your application needs to read/write data stored in a Cloud Storage bucket in the same project. You want to grant access to your application following the principle of least privilege. What should you do?
A) Create a user-managed service account with a custom Identity and Access Management (IAM) role.
B) Create a user-managed service account with the Storage Admin Identity and Access Management (IAM) role.
C) Create a user-managed service account with the Project Editor Identity and Access Management (IAM) role.
D) Use the default service account linked to the Cloud Run revision in production.

Google Professional Cloud Developer Exam - Topic 4 Question 119 Discussion

Actual exam question for Google's Professional Cloud Developer exam
Question #: 119
Topic #: 4
[All Professional Cloud Developer Questions]

You have an application written in Python running in production on Cloud Run. Your application needs to read/write data stored in a Cloud Storage bucket in the same project. You want to grant access to your application following the principle of least privilege. What should you do?

Show Suggested Answer Hide Answer
Suggested Answer: A

https://cloud.google.com/iam/docs/understanding-roles#storage.admin


by Dong at Apr 06, 2026, 10:28 AM

Limited Time Offer

25%

Off

Get Premium Professional Cloud Developer Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Shenika
4 days ago
C is overkill. Project Editor gives too much access.
upvoted 0 times
...
Emogene
9 days ago
D is risky. Default accounts have too many permissions.
upvoted 0 times
...
Eulah
14 days ago
B is too broad. We only need specific access.
upvoted 0 times
...
Delmy
19 days ago
But what about B? Storage Admin seems powerful.
upvoted 0 times
...
Crista
24 days ago
I agree, A makes sense. Custom roles are flexible.
upvoted 0 times
...
Dorian
30 days ago
I think option A is the best choice. Least privilege is key.
upvoted 0 times
...
Cassie
1 month ago
Definitely go with A) for custom roles!
upvoted 0 times
...
Lajuana
1 month ago
C) seems too broad for this case.
upvoted 0 times
...
Shad
2 months ago
Surprised that D) is even an option!
upvoted 0 times
...
Marya
2 months ago
I disagree, B) gives more control.
upvoted 0 times
...
Carlee
2 months ago
A) is the best choice for least privilege.
upvoted 0 times
...
Laquita
2 months ago
C) sounds risky, why give editor access when you don't need it?
upvoted 0 times
...
Polly
2 months ago
Wait, can you really use the default service account safely?
upvoted 0 times
...
Hobert
2 months ago
B) seems too broad for just reading/writing.
upvoted 0 times
...
Mayra
4 months ago
Totally agree, custom roles are the way to go!
upvoted 0 times
...
Isreal
4 months ago
A) is the best choice for least privilege.
upvoted 0 times
...
Stephen
5 months ago
I recall that using the default service account might give too many permissions, so I think we should avoid that option.
upvoted 0 times
...
Dante
5 months ago
I’m leaning towards option A, but I’m a bit uncertain if the custom role would cover all the necessary permissions for Cloud Storage.
upvoted 0 times
...
Devora
5 months ago
I think we practiced a similar question where we had to choose between custom roles and predefined ones. I feel like a custom role might be too complex for this case.
upvoted 0 times
...
Nu
5 months ago
I remember we talked about the principle of least privilege, but I'm not sure which IAM role would be the best fit for just reading and writing to Cloud Storage.
upvoted 0 times
...

Save Cancel