Courseiva
← ACE
Full test
easyMultiple ChoiceObjective-mapped

Google ACE Practice Question: Refer to the exhibit

Exhibit

{
  "bindings": [
    {
      "role": "roles/storage.objectViewer",
      "members": [
        "allAuthenticatedUsers"
      ]
    }
  ]
}

Refer to the exhibit. After applying this IAM policy to a bucket, what access is granted?

⚠ Common exam trap

Google Cloud often tests the distinction between `allUsers` (anyone on the internet, no authentication) and `allAuthenticatedUsers` (requires Google authentication), and candidates frequently confuse the two, thinking `allAuthenticatedUsers` means 'anyone' or 'same project only'.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Anyone authenticated with a Google account can list and read objects

The IAM policy grants the `roles/storage.objectViewer` role to `allAuthenticatedUsers`, which includes any identity authenticated with a Google account (including non-GCP accounts). The condition `resource.name.startsWith('projects/_/buckets/example-bucket/objects/public/')` restricts the grant to objects whose path starts with `public/`, so only those objects can be listed and read. This is why option A is correct.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✓

    Anyone authenticated with a Google account can list and read objects

    Why this is correct

    This statement is correct. The IAM principal `allAuthenticatedUsers` is a special identifier that represents every identity authenticated by Google, including Gmail users, Google Workspace accounts, and service accounts, regardless of which GCP project they belong to. When bound to a role such as `roles/storage.objectViewer` on a Cloud Storage bucket, it grants permissions like `storage.objects.list` and `storage.objects.get`, enabling these users to list and read objects in that bucket.

  • ✗

    No access is granted because the condition is missing

    Why it's wrong here

    This is incorrect because IAM policy bindings are valid with or without a condition. The absence of a `condition` block does not invalidate the binding; it simply means the permission grant is unconditional and applies to all matching principals. Here, the missing condition is not a problem — access is granted directly to `allAuthenticatedUsers`, and no conditional logic is required for the policy to take effect.

  • ✗

    Only users in the same GCP project can read objects

    Why it's wrong here

    This is incorrect because `allAuthenticatedUsers` is not scoped to the same GCP project. This principal includes any Google-authenticated identity across all of Google, no matter what organization or project they belong to. Unless the policy includes an explicit condition such as `resource.matchTag` or a project-level restriction, there is no mechanism limiting access to only users inside the same GCP project.

  • ✗

    Anyone on the internet can list and read objects

    Why it's wrong here

    This is incorrect because `allAuthenticatedUsers` explicitly excludes anonymous or unauthenticated users; it only covers identities that have signed in to Google. To grant access to the entire public internet without requiring authentication, the policy would need to use `allUsers` as the principal. Since the exhibit uses `allAuthenticatedUsers`, people who are not logged into a Google account cannot list or read the bucket's objects.

About these practice questions

This ACE question is part of Courseiva's 769-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.