easyMultiple ChoiceObjective-mapped
Google ACE Practice Question: A developer accidentally grants the Owner role to…
A developer accidentally grants the Owner role to a test service account on the production project. The team wants to remove only this specific IAM binding without affecting other members' access. Which gcloud command achieves this?
⚠ Common exam trap
Google Cloud often tests the distinction between commands that modify the entire policy (`set-iam-policy`) versus those that surgically remove a single binding (`remove-iam-policy-binding`), and candidates may confuse the valid command syntax or assume a generic `remove-binding` subcommand exists.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
gcloud projects remove-iam-policy-binding [PROJECT] --member=serviceAccount:[SA_EMAIL] --role=roles/owner
`gcloud projects remove-iam-policy-binding` is the precise command to remove a single IAM binding (member-role pair) from a project's policy without affecting other bindings. It takes the project ID, member (service account email), and role as parameters, ensuring only the specified binding is removed. This command modifies the existing policy by removing only that specific entry, leaving all other IAM bindings intact.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
gcloud projects set-iam-policy [PROJECT] --member=serviceAccount:[SA] --role=roles/owner
Why it's wrong here
The gcloud projects set-iam-policy command is for replacing the entire IAM policy of a project with a new policy supplied via a file or stdin, not for modifying a single binding. This command does not accept --member or --role flags; instead, you need to provide a policy YAML/JSON obtained via get-iam-policy. If used improperly, it would overwrite all existing bindings, causing an accidental wholesale removal of permissions—making it a dangerous, heavy-handed approach compared to remove-iam-policy-binding.
- ✓
gcloud projects remove-iam-policy-binding [PROJECT] --member=serviceAccount:[SA_EMAIL] --role=roles/owner
Why this is correct
This is the correct command because it surgically removes the specified service account from the roles/owner role on the project while leaving every other IAM binding untouched. The command takes the project name, member string in serviceAccount: format, and role ID to precisely identify the binding to delete. It is the safe, expected way to revoke a single principal's role, and it performs an atomic update to the IAM policy without requiring you to fetch or rewrite the entire policy.
- ✗
gcloud iam remove-binding --project=[PROJECT] --member=[SA] --role=owner
Why it's wrong here
The command gcloud iam remove-binding is not a valid gcloud command; the gcloud iam group does not have a remove-binding subcommand. Even if it did, it would need the role ID in the roles/owner format and the member in serviceAccount: format, not a bare owner or unqualified email. The correct CLI path is gcloud projects remove-iam-policy-binding, which is scoped to the project resource and designed exactly for this purpose.
- ✗
gcloud projects delete-member [PROJECT] --member=serviceAccount:[SA_EMAIL]
Why it's wrong here
The command gcloud projects delete-member does not exist; there is no such subcommand under gcloud projects for IAM management. To revoke a role, you must use gcloud projects remove-iam-policy-binding, which explicitly removes a member from a specified role. Trying to use an undefined command would result in an error, and it also omits both the role and the service account email format, so it cannot identify the binding to remove.
Go deeper
Related to this question
Learn chapter
GCP IAM and Service Accounts
Key term
IAM
Identity and Access Management (IAM) is a framework of policies and technologies that ensures the right individuals have the appropriate access to technology resources.
Key term
Service
A service is a software component or system that performs a specific function and is available to be used by other programs or users over a network.
About these practice questions
This ACE question is part of Courseiva's 769-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.