Google ACE Configuring Access and Security Practice Question
An engineer needs to view the current IAM policy for a project in JSON format. Which gcloud command should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
gcloud projects get-iam-policy PROJECT_ID --format json
The gcloud projects get-iam-policy command retrieves the IAM policy for a project. The --format flag allows you to specify the output format, such as JSON. The other commands are for different purposes: set-iam-policy sets the policy, add-iam-policy-binding adds a binding, and describe-iam-policy does not exist.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
gcloud iam projects describe-iam-policy PROJECT_ID --format json
Why it's wrong here
The 'gcloud iam' command group manages IAM resources like roles and service accounts, not project-level policies. There is no 'describe-iam-policy' verb anywhere in the gcloud CLI; the correct project policy command lives under 'gcloud projects' and uses the verb 'get-iam-policy'. Attempting this option yields a 'command not found' error, so it cannot retrieve anything.
- ✗
gcloud projects add-iam-policy-binding PROJECT_ID --format json
Why it's wrong here
This command is a mutating operation that requires the --member and --role flags to add a new principal to a role binding. It does not display the current policy; it modifies it and returns only the updated policy's member list in JSON if --format is applied. To view the full policy, you need a read-only command, not a write command that changes state.
- ✗
gcloud projects set-iam-policy PROJECT_ID --format json
Why it's wrong here
'set-iam-policy' overwrites the entire project IAM policy with a policy file provided via --policy-file or stdin. It is a destructive write operation; without a valid policy file, it will fail or replace existing bindings with an empty policy. The --format flag only shapes the output of the command's result, not the input, so it never shows the current policy.
- ✓
gcloud projects get-iam-policy PROJECT_ID --format json
Why this is correct
This is the correct read-only command for retrieving a project's IAM policy. It outputs the complete policy document, including bindings, version, etag, and audit configs, and '--format json' formats that document as JSON for easy parsing. It is the standard tool for viewing current IAM state and is the basis for making offline changes with set-iam-policy.
Go deeper
Related to this question
Learn chapter
GCP Projects, Folders, and Organizations
Key term
IAM policy
An IAM policy is a set of rules that determines who can access specific cloud resources and what actions they are allowed to perform.
Key term
IAM
Identity and Access Management (IAM) is a framework of policies and technologies that ensures the right individuals have the appropriate access to technology resources.
About these practice questions
One of 769 original ACE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.