Google ACE Configuring Access and Security Practice Question
An organization has a folder hierarchy with multiple projects. They want to grant a support team the ability to view all IAM policies across the entire folder. What is the most efficient way?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Grant roles/iam.securityReviewer at the folder level.
Granting the role at the folder level applies to all projects under it, which is efficient and follows best practices for hierarchical IAM.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Grant roles/iam.securityReviewer at the folder level.
Why this is correct
Granting roles/iam.securityReviewer at the folder level is correct because IAM permissions propagate through the resource hierarchy. This predefined role includes resourcemanager.folders.getIamPolicy and resourcemanager.projects.getIamPolicy, allowing the user to read IAM policies on the folder and every project, folder, and resource beneath it. Because the audit scope is the entire folder hierarchy, one grant at the folder root covers all child projects without per-project assignments, satisfying the requirement efficiently and with least privilege.
- ✗
Grant roles/iam.securityReviewer on each project individually.
Why it's wrong here
Granting roles/iam.securityReviewer on each project individually fails because the requirement is to view policies across the *entire folder hierarchy*, not per-project. This approach would require enumerating and assigning the role to every project, which is inefficient and does not scale to folder-level inheritance. It is tempting because the role does grant read access to IAM policies, and in a scenario where access is needed only to specific projects (not the whole folder), assigning it per project would be correct.
- ✗
Grant roles/owner at the folder level.
Why it's wrong here
Granting roles/owner at the folder level is an over-privileged solution. The owner role includes the securityReviewer permissions but also adds full management capabilities such as granting roles, deleting resources, and configuring billing, which go far beyond the stated need to view policies. Using owner here violates the principle of least privilege and introduces unnecessary security risk; a read-only, IAM-policy-specific role is required instead.
- ✗
Grant roles/viewer at the folder level.
Why it's wrong here
Granting roles/viewer at the folder level seems plausible because viewer provides read access to many resources, but it does not include the getIamPolicy permissions required to view IAM policies. Specifically, roles/viewer lacks resourcemanager.projects.getIamPolicy and resourcemanager.folders.getIamPolicy, so a user with this role cannot list or inspect the policies on projects or folders in the hierarchy. Thus, despite its name, viewer is not sufficient for this task.
Go deeper
Related to this question
Learn chapter
GCP Projects, Folders, and Organizations
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
Key term
Folder
A folder is a logical container used to organize and group digital files, resources, or cloud-based assets within a system or platform.
About these practice questions
Courseiva writes every ACE question from scratch — 769 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.