hardMultiple ChoiceObjective-mapped
Google ACE Practice Question: A security auditor needs to check whether a…
A security auditor needs to check whether a specific user (user@company.com) currently has sufficient permissions to delete a Cloud SQL instance in project 'prod-db'. Without making any changes, which tool simulates this check?
⚠ Common exam trap
Google Cloud often tests the misconception that a dry-run flag or manual policy inspection is sufficient for permission checks, but the trap here is that only the IAM Policy Troubleshooter provides a comprehensive, no-change simulation that evaluates all policy types and inheritance paths, which is essential for security audits.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the IAM Policy Troubleshooter (Policy Simulator) to check if the permission is granted
The IAM Policy Troubleshooter (Policy Simulator) is the correct tool because it allows you to check whether a specific user has a particular permission (e.g., cloudsql.instances.delete) on a given resource (the Cloud SQL instance in project 'prod-db') without making any changes. It evaluates the effective IAM policy, including all inherited roles and policies, and returns a result indicating whether the permission is granted. This directly addresses the auditor's need to simulate a permission check without executing any action.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Run the delete command with `--dry-run` flag to simulate without executing
Why it's wrong here
The `gcloud sql instances delete` command does not support a `--dry-run` flag, so this approach would fail syntactically, and even if it existed, the CLI still requires valid credentials and permission to execute the API call before it could simulate anything. A user lacking the permission would get a denial rather than a simulation. The Policy Troubleshooter is purpose-built to check IAM access without invoking the resource operation itself.
- ✓
Use the IAM Policy Troubleshooter (Policy Simulator) to check if the permission is granted
Why this is correct
The IAM Policy Troubleshooter (also known as the Policy Simulator in some contexts) calculates the effective IAM policy for a specific principal, permission, and resource, taking into account inherited roles, group memberships, conditional bindings, and deny policies. For a Cloud SQL delete, it can verify whether the principal has the `cloudsql.instances.delete` permission. It provides an immediate, non-destructive answer through the Cloud Console or the `gcloud policy-troubleshoot` CLI, without requiring any policy changes.
- ✗
Inspect the IAM policy with `gcloud projects get-iam-policy` and manually trace inheritance
Why it's wrong here
Manually running `gcloud projects get-iam-policy` and tracing inheritance is unreliable because effective IAM is a combination of roles from organizations, folders, projects, and the Cloud SQL instance resource itself, plus group memberships, deny policies, and conditional bindings. Aggregating these manually is error-prone and does not compute the final effective permission. The Policy Troubleshooter automatically evaluates all applicable policies and provides a definitive answer quickly.
- ✗
Grant the user the permission temporarily, test the delete, then revoke it
Why it's wrong here
Temporarily granting the user a role like `roles/cloudsql.admin` to test the delete operation changes the very policy you are trying to verify and may introduce greater access than intended, creating a security risk. It also does not account for whether the user already has the permission through a different role, group, or conditional binding. The IAM Policy Troubleshooter answers non-destructively without any modification to existing IAM policies.
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
Cloud SQL
Cloud SQL is a fully managed relational database service that lets you set up, maintain, and scale SQL databases (like MySQL, PostgreSQL, and SQL Server) in the cloud without managing the underlying infrastructure.
Key term
IAM
Identity and Access Management (IAM) is a framework of policies and technologies that ensures the right individuals have the appropriate access to technology resources.
About these practice questions
This ACE question is part of Courseiva's 769-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.