easyMultiple ChoiceObjective-mapped
Google ACE Practice Question: Which gcloud command lists all available roles…
Which gcloud command lists all available roles that can be granted on a GCP project, including both predefined and custom roles?
⚠ Common exam trap
Google Cloud often tests the distinction between listing roles that *can* be granted (grantable roles) versus listing roles that *are* granted (current bindings), and candidates confuse `gcloud iam roles list` (custom roles only) with the correct command for all grantable roles.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
`gcloud iam list-grantable-roles //cloudresourcemanager.googleapis.com/projects/PROJECT_ID`
The `gcloud iam list-grantable-roles` command is specifically designed to list all roles (both predefined and custom) that can be granted on a given resource, such as a GCP project. The resource is identified by its canonical name, which for a project is `//cloudresourcemanager.googleapis.com/projects/PROJECT_ID`. This command returns roles that are eligible for binding at that resource level, including those inherited from ancestors.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
`gcloud iam roles list --project=PROJECT_ID`
Why it's wrong here
The command `gcloud iam roles list --project=PROJECT_ID` only enumerates custom roles that you have defined in that specific project. It deliberately excludes all predefined roles like roles/editor or roles/viewer, which are global, service-owned roles not scoped to a single project. Because the question asks for every role that can be granted on the project, this command returns an incomplete list that misses the vast majority of roles available in the IAM catalog.
- ✓
`gcloud iam list-grantable-roles //cloudresourcemanager.googleapis.com/projects/PROJECT_ID`
Why this is correct
The command `gcloud iam list-grantable-roles //cloudresourcemanager.googleapis.com/projects/PROJECT_ID` takes a canonical resource name and calls the IAM API's listGrantableRoles method, which returns every role—predefined and custom—that can be placed on that resource's IAM policy. For a project, the required canonical form is the Cloud Resource Manager resource name, prefixed with the service name. This is the only option that directly lists the full set of grantable roles for the project, making it the correct answer.
- ✗
`gcloud projects get-iam-policy PROJECT_ID`
Why it's wrong here
`gcloud projects get-iam-policy PROJECT_ID` inspects the project's current IAM policy bindings, showing exactly which members are bound to which roles at this moment. It is a snapshot of existing assignments, not a catalog of grantable role definitions. Consequently, it cannot reveal roles that are grantable but not currently used, and even the roles it shows are only those already in effect on the project.
- ✗
`gcloud iam roles describe roles/editor`
Why it's wrong here
`gcloud iam roles describe roles/editor` is designed to show metadata for a single, already-known role, such as its title, description, and the exact permissions it includes. You must supply the precise role name upfront, so it cannot discover other roles that are grantable on the project. It answers the question "what does this role do?" rather than the question "which roles can be granted here?".
Go deeper
Related to this question
About these practice questions
This ACE question is part of Courseiva's 769-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.