GCP ACE · Question 41 · Domain 5.1: Managing Identity and Access Management (IAM)
You need to grant a contractor the ability to start and stop Compute Engine instances, but they must NOT be able to create new instances or delete existing ones. No predefined role perfectly matches this requirement.
What should you do?
Answer options:
Grant the 'Compute Instance Admin' role.
Create a custom IAM role containing only the 'compute.instances.start' and 'compute.instances.stop' permissions.
Grant the 'Compute Viewer' role and use a firewall rule to block instance creation.
Use an IAM Deny policy to block 'compute.instances.create'.
50 questions · hints · full answers · grading
Expert