Google ACE Configuring Access and Security Practice Question
An engineer needs to view the current IAM policy for a project in JSON format to analyze bindings. Which command should be used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
gcloud projects get-iam-policy my-project --format json
The command gcloud projects get-iam-policy PROJECT_ID --format json retrieves the IAM policy for the project in JSON format. Other commands either get policies for different resources or use a different format.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
gcloud resource-manager folders get-iam-policy my-project --format json
Why it's wrong here
This command is incorrect because it targets the resource-manager folders subcommand, which expects a folder ID rather than a project ID. Even if a folder with the name 'my-project' existed, gcloud would retrieve the IAM policy for that folder, not for the project. The correct scope for project IAM policies is the 'gcloud projects' command group, not 'gcloud resource-manager folders'.
- ✗
gcloud projects get-iam-policy my-project --format yaml
Why it's wrong here
The command correctly uses 'gcloud projects get-iam-policy' and supplies the project ID, but it specifies '--format yaml', which outputs the policy in YAML rather than JSON. Since the engineer explicitly needs to view the policy in JSON format, the output format does not meet the requirement. The fix is to change the format flag to '--format json' while keeping the rest of the command unchanged.
- ✓
gcloud projects get-iam-policy my-project --format json
Why this is correct
This is the correct command. It uses the 'gcloud projects get-iam-policy' subcommand to retrieve the IAM policy for the specified project ID ('my-project') and sets the output format to JSON via '--format json'. The command returns the Policy object containing bindings, roles, members, etag, and version, all serialized in the requested JSON structure.
- ✗
gcloud iam policies get my-project --format json
Why it's wrong here
This command is invalid because 'gcloud iam policies' is not a recognized subcommand group in the gcloud CLI. The 'gcloud iam' group contains commands for managing roles and service accounts, but IAM policy retrieval is done through resource-specific commands such as 'gcloud projects get-iam-policy', 'gcloud folders get-iam-policy', or 'gcloud organizations get-iam-policy'. Attempting to run this command will yield a 'command not found' error.
Go deeper
Related to this question
Learn chapter
GCP Projects, Folders, and Organizations
Key term
IAM policy
An IAM policy is a set of rules that determines who can access specific cloud resources and what actions they are allowed to perform.
Key term
IAM
Identity and Access Management (IAM) is a framework of policies and technologies that ensures the right individuals have the appropriate access to technology resources.
About these practice questions
This ACE question is part of Courseiva's 769-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.