Google ACE Configuring Access and Security Practice Question
An organization has a hierarchy: Organization -> Folder A -> Project 1. An IAM policy at the organization level grants roles/editor to user@example.com. A policy at Folder A denies roles/editor to the same user. What is the effective role for the user in Project 1?
⚠ Common exam trap
The trap is assuming that a higher-level allow (organization) always wins over a lower-level deny (folder) — in GCP, deny policies are evaluated first and override inherited allows.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The user does not have the editor role in Project 1 because the deny policy at the folder level blocks it.
In Google Cloud IAM, deny policies take precedence over allow policies in the resource hierarchy. A deny policy at Folder A blocks the roles/editor grant even though the organization-level allow policy grants it, because the deny is evaluated first and overrides any inherited allow for that principal and permission. Therefore the user has no editor role in Project 1.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The user has the editor role only in resources directly under the organization, not under Folder A.
Why it's wrong here
This misreads IAM hierarchy inheritance. In Google Cloud, IAM policies are inherited from the organization to folders and then to projects, so the editor role granted at the organization level normally propagates to Project 1. However, a deny policy applied at Folder A is also inherited by all resources beneath that folder, including Project 1. Deny policies take precedence over allow policies, so the user's editor permission is blocked in Project 1 despite the organization-wide grant.
- ✓
The user does not have the editor role in Project 1 because the deny policy at the folder level blocks it.
Why this is correct
IAM deny policies are evaluated with higher precedence than allow policies, so a deny rule on Folder A explicitly blocks any inherited editor grant from reaching resources below that folder. Project 1, being a child of Folder A, inherits both the organization-level editor role and the folder-level deny, but deny rules win. As a result, even though the user was granted editor at the organization, the user's effective permissions in Project 1 do not include editor; the deny policy specifically prevents that role from being granted.
- ✗
The user has the editor role because organization-level grants override folder-level denials.
Why it's wrong here
This gets the precedence backwards. While the organization is the root of the IAM hierarchy and its allow policies normally propagate down, denial policies are not overridden by higher-level allow grants. Google Cloud's IAM deny policies are designed to take precedence over all allow policies, regardless of where in the hierarchy the allow was defined. Therefore, a folder-level deny on Folder A overrides the organization-level editor grant for any descendant project like Project 1.
- ✗
The user has the editor role in Project 1 unless there is a specific project-level deny.
Why it's wrong here
Deny policies are inherited from a folder to all projects within it, just as allow policies are, so no additional project-level deny is required to block the editor role. The folder-level deny on Folder A is already in effect for Project 1 and prevents the inherited editor grant from applying. A project-level deny would only be needed to negate a project-specific allow, but here the same outcome is achieved by the broader folder deny.
Go deeper
Related to this question
Learn chapter
GCP Organization Policies
Key term
Folder
A folder is a logical container used to organize and group digital files, resources, or cloud-based assets within a system or platform.
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
About these practice questions
Courseiva writes every ACE question from scratch — 775 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Google Cloud exam blueprint
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.