You have a CI/CD pipeline running in 'Project-A'. The pipeline needs to deploy a Cloud Function into 'Project-B'. The pipeline authenticates using a Service Account located in 'Project-A'.

Which TWO steps are required to allow the pipeline to deploy the function? (Select TWO)

Answer options:

Grant the Service Account from Project-A the 'Cloud Functions Developer' role in Project-B.

Copy the Service Account from Project-A to Project-B.

Grant the Service Account from Project-A the 'Service Account User' role on the runtime service account in Project-B.

Set up VPC Network Peering between Project-A and Project-B.

Create a new Service Account in Project-B and link it to Project-A.

How to approach this question

Understand cross-project IAM and the permissions required to deploy compute resources.

Full Answer

Service accounts can be granted roles in projects other than the one they were created in. To deploy a Cloud Function, the deploying identity needs two things: 1) Permission to create the function (Cloud Functions Developer). 2) Permission to attach a runtime service account to the function (Service Account User role on the target service account).

Common mistakes

Forgetting the 'Service Account User' role, which is a common cause of deployment failures.

Question 44 All questions Question 46

Practice the full GCP Associate Cloud Engineer Practice Exam 2

50 questions · hints · full answers · grading

More questions from this exam

Q01Your company is migrating to Google Cloud and needs to establish a resource hierarchy. You have t...Easy Q02You are managing access to a GCP project. You need to grant 15 developers the ability to view Com...Medium Q03You have created a new GCP project using the Cloud Console. You want to deploy a Cloud Function u...Easy Q04Your startup has a strict monthly cloud budget of $500. You want to be notified immediately if yo...Easy Q05Your finance team wants to perform complex SQL analysis on your GCP billing data to understand co...Medium

View all 50 questions →