Google ACE Practice Question: A project has the following IAM bindings: User A…

A project has the following IAM bindings: User A has `roles/editor` at the project level, and a folder-level policy denies `roles/editor` to User A. Which effective permission does User A have on the project?

⚠ Common exam trap

Google Cloud often tests the misconception that 'lower-level grants override higher-level denials' or that 'conflicting policies result in no access,' when in fact Deny policies at any level take precedence over Allow bindings at any lower level.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

User A is denied Editor permissions because IAM Deny policies at a parent resource override allow grants at child resources.

In Google Cloud, IAM Deny policies at a parent resource (like a folder) override allow bindings at a child resource (like a project). Even though User A has `roles/editor` granted at the project level, the folder-level Deny policy explicitly denies that role, so the effective permission is denial. This follows the principle that Deny policies are evaluated before Allow bindings and take precedence.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
User A has Editor permissions because project-level IAM takes precedence over folder-level.
Why it's wrong here
Standard IAM allow policies are purely additive and do not establish precedence between project-level and folder-level grants. In Google Cloud's IAM hierarchy, folder-level IAM Deny policies are evaluated independently and always override any allow binding at a child project for the denied permissions. Therefore User A's project-level Editor role is ineffective if a parent folder denies Editor permissions; there is no 'closer wins' rule that lets a child allow supersede a parent deny.
✓
User A is denied Editor permissions because IAM Deny policies at a parent resource override allow grants at child resources.
Why this is correct
IAM Deny policies, when set at a folder level, prevent the denied permissions from taking effect on all child resources, including the project — even if the project has an allow binding for those permissions. Deny takes precedence over allow.
✗
User A has no permissions because conflicting policies result in no access.
Why it's wrong here
A conflicting allow and deny does not nullify all access — IAM Deny blocks only the specific permissions named in its deny rules, not the entire role or all roles. User A may still hold other roles or permissions not covered by the deny, and those remain fully effective. Thus the result is 'denied only for Editor permissions,' not 'no permissions at all.'
✗
User A has Editor permissions because folder-level policies don't apply to individual projects.
Why it's wrong here
Google Cloud IAM hierarchy mandates inheritance: any IAM policy (allow or deny) applied at a folder level propagates to every project and resource nested under that folder. A folder-level IAM Deny policy denying Editor permissions therefore applies to the project in question regardless of where the project sits below the folder. The only way to avoid it would be to place the project outside that folder or use a deny policy exception, not by assuming folder policies don't reach projects.

Go deeper

Google ACE Practice Question: A project has the following IAM bindings: User A…

Why each option matters

Option-by-option breakdown

Related to this question