IAM & monitoring

In GCP IAM, access is granted by assigning roles—collections of permissions—to identities such as users, groups, or service accounts, thereby controlling what actions can be performed on resources. IAM does not manage network settings, storage classes, or firewall rules directly; those are configured through separate services. Choice B is a trap because network configurations are handled by VPC and firewall resources, not by IAM permissions.

A service account in GCP represents a non‑human identity used by applications or services to obtain OAuth tokens and call GCP APIs securely, with its own set of IAM roles. It is not intended for interactive human login, which relies on user accounts; thus choice A is misleading. Service accounts can also be used by automated pipelines, not merely external vendors or customers.

In GCP IAM, access is granted by assigning roles—collections of permissions—to identities such as users, groups, or service accounts, thereby controlling what actions can be performed on resources. A diagram for this topic isn't available yet — the worked example below walks the same reasoning step by step.

• !Choice B is a trap because network configurations are handled by VPC and firewall resources, not by IAM permissions.
• !It goes far beyond simple cost reporting, which is handled by Cloud Billing, making Option A incorrect.

Answer each from memory — you'll see instantly whether you're right and why.

Run a focused 10-question mini-mock on IAM & monitoring and see it stick.