easyMultiple ChoiceObjective-mapped
Google ACE Practice Question: A developer runs `gcloud projects list` and…
A developer runs `gcloud projects list` and receives the error: `ERROR: (gcloud.projects.list) PERMISSION_DENIED: The caller does not have permission`. The developer has the Viewer role on several projects. What is the most likely cause?
⚠ Common exam trap
Google Cloud often tests the misconception that project-level roles like Viewer are sufficient for listing projects, when in reality the `resourcemanager.projects.list` permission must be granted at a higher level in the resource hierarchy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The developer lacks `resourcemanager.projects.list` at the organization or folder level.
The `gcloud projects list` command requires the `resourcemanager.projects.list` permission, which is granted at the organization or folder level, not at the individual project level. Even with the Viewer role on several projects, the developer lacks this specific permission at the resource hierarchy level above the projects, causing the PERMISSION_DENIED error.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The developer does not have multi-factor authentication enabled.
Why it's wrong here
Multi-factor authentication (MFA) is an authentication requirement that is enforced at login time, not during API authorization. Once the developer has valid credentials (e.g., a refresh token or service account key), the gcloud command is authenticated; the PERMISSION_DENIED error comes from the Cloud Resource Manager API's IAM authorization layer, which checks the caller's granted permissions, not their authentication method. Even if MFA is required by an organization policy, the failure would manifest as a login challenge or an OAuth error, not a PERMISSION_DENIED from the resource manager API.
- ✓
The developer lacks `resourcemanager.projects.list` at the organization or folder level.
Why this is correct
The permission `resourcemanager.projects.list` is evaluated against the parent resource (organization or folder) where the developer is attempting to list projects, not against each project individually. The Project Viewer role (roles/viewer) only grants permissions within a specific project, so while the developer can view a project they're already in, `gcloud projects list` needs an IAM role at the folder or organization level to enumerate all projects in that hierarchy. Without that permission at the parent, the API returns PERMISSION_DENIED even if the developer has viewer access to many projects.
- ✗
The gcloud SDK is outdated and must be updated.
Why it's wrong here
An outdated gcloud SDK may produce version warnings, suggest updates, or fail to interpret newer API fields, but it does not cause the Cloud Resource Manager API to return PERMISSION_DENIED. The error is generated by the server-side IAM policy engine after the API receives the request; the SDK version does not change what permissions the authenticated principal has. If the SDK were actually unable to call the API because it's too old, the error would be an API version mismatch or an offline authentication failure, not an IAM authorization error.
- ✗
The developer's account has been suspended by the billing administrator.
Why it's wrong here
Billing suspension or disabling of the GCP account affects the provisioning and use of billable resources, such as starting VMs or creating buckets, but it does not alter IAM permission checks for read-only metadata operations like listing projects. When an account is suspended, calls to list or view resources typically fail with a billing-related error (e.g., 'billing account is disabled') or a 403 with a different reason, not an IAM permission-denied message. The developer's ability to call `resourcemanager.projects.list` depends solely on their IAM role, not on the billing account's state.
Go deeper
Related to this question
Learn chapter
GCP Projects, Folders, and Organizations
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
Key term
Resource hierarchy
Resource hierarchy is the structured, parent-child ordering of cloud resources that governs access control, policy inheritance, and resource organization across a cloud platform.
About these practice questions
One of 769 original ACE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.