Google ACE Configuring Access and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  gcloud projects get-iam-policy my-project --format json

  Why this is correct

  This is the correct command to retrieve the IAM policy for a specific project, and using `--format json` explicitly instructs the CLI to output the policy as a JSON object. The `--format` flag does not change the underlying policy data, but it provides a structured, machine-readable representation that is ideal for scripting with tools like `jq` or for programmatic inspection. Without this flag, the same data would be rendered in YAML by default, so this flag only ensures the output format is standard and predictable.

• ✗

  gcloud resource-manager folders get-iam-policy my-folder

  Why it's wrong here

  This command targets a Cloud Folder resource, not a project. `gcloud resource-manager folders get-iam-policy` fetches the IAM policy that is directly attached to a specific folder within the organization hierarchy, and requires a folder ID as its argument. Since the engineer wants the policy for the project `my-project`, this command would either error out (because `my-folder` is not a valid folder) or return a different resource's policy, making it inappropriate for this task.

• ✗

  gcloud iam service-accounts get-iam-policy my-sa@my-project.iam.gserviceaccount.com

  Why it's wrong here

  This command retrieves the IAM policy for a service account resource, not for the project as a whole. The service account policy governs who can use or administer that specific service account (e.g., roles/iam.serviceAccountUser, roles/iam.serviceAccountAdmin), which is a separate and much narrower scope than the project-level IAM policy that defines roles like roles/owner, roles/editor, or roles/viewer for the entire project. Even though the service account belongs to `my-project`, its IAM policy is isolated from the project's resource-level policy.

• ✓

  gcloud projects get-iam-policy my-project

  Why this is correct

  This is the standard, straightforward command to view the IAM policy of a project. `gcloud projects get-iam-policy my-project` retrieves the full set of IAM bindings applied directly to the project resource, including roles and members, and by default outputs it in YAML format for easy human reading. This is the correct way to inspect the project's own policy without any inherited or ancestor policies mixed in.

• ✗

  gcloud projects get-ancestors-iam-policy my-project

  Why it's wrong here

  This command retrieves the IAM policies of the project and all of its ancestors in the resource hierarchy (e.g., folders and organization), combining them to show the effective, inherited bindings. However, the question asks for the project's own current IAM policy, not the aggregated ancestor policies, so it overreaches and returns additional data that is not part of the project's direct bindings. Using `--ancestors-iam-policy` is helpful for auditing effective permissions, but it is not the correct way to view just the project's policy.

Go deeper

Related to this question