mediumMultiple ChoiceObjective-mapped
Google ACE Practice Question: A security audit found that several Cloud Storage…
A security audit found that several Cloud Storage buckets in your project have `allAuthenticatedUsers` in their IAM policy with `storage.objectViewer`. What does `allAuthenticatedUsers` grant, and why is it a security risk?
⚠ Common exam trap
Google Cloud often tests the distinction between `allAuthenticatedUsers` and `allUsers`, where candidates mistakenly think `allAuthenticatedUsers` is safe because it requires authentication, but the trap is that any Google account (free or otherwise) qualifies, making it nearly as risky as `allUsers` for sensitive data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It grants read access to any person with a Google account — effectively near-public access since Google accounts are free to create.
`allAuthenticatedUsers` is a special IAM member that includes any person authenticated with a Google account, regardless of whether they belong to your organization or domain. Granting `storage.objectViewer` to this group means anyone with a free Google account (e.g., Gmail) can list and read objects in the bucket, making the data effectively public. This is a significant security risk because it exposes sensitive data to a vast, uncontrolled audience.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It grants access only to users within your Google Workspace domain — a minor risk if your domain is small.
Why it's wrong here
allAuthenticatedUsers is not restricted to your Google Workspace domain. It includes every Google account from every domain on Earth, including personal Gmail addresses and accounts from other organizations. Your own domain users would only be a tiny subset of the identities this principal covers; the 'allUsers' principal actually means anyone, signed in or not, while your domain is a much narrower IAM binding concept.
- ✓
It grants read access to any person with a Google account — effectively near-public access since Google accounts are free to create.
Why this is correct
In Cloud IAM, allAuthenticatedUsers is a special principal that matches any identity that is authenticated with Google, which includes not only your organization's users but every Gmail account, Workspace account, and even service account in the world. Because anyone can create a Google account for free, this permission is functionally equivalent to public access — a random individual only needs a few seconds to sign up and gain the granted role. For internal or sensitive data, this exposure is unacceptable, so the security risk is severe rather than minor.
- ✗
It grants access only to Google service accounts, which is acceptable since those are controlled.
Why it's wrong here
This confuses the principal allAuthenticatedUsers with service accounts. While service accounts are indeed Google accounts, allAuthenticatedUsers also includes human Google accounts (Gmail, Workspace) and any other authenticated identity. There is no requirement that the account be a service account, so you cannot assume only your controlled service accounts are affected; any personal Google account holder can be granted the role.
- ✗
It grants access to authenticated GCP users in your organization's IAM policy — this is normal for shared resources.
Why it's wrong here
This claim misdescribes the scope of allAuthenticatedUsers. It does not filter to users in your organization's IAM policy; instead it matches all Google account holders globally, regardless of whether they are in your Cloud Identity, Workspace domain, or any project you administer. Granting a role to allAuthenticatedUsers means any authenticated Google user can access the resource, not just your own logged-in users or internal principals.
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
Key term
IAM policy
An IAM policy is a set of rules that determines who can access specific cloud resources and what actions they are allowed to perform.
About these practice questions
This ACE question is part of Courseiva's 769-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.