Google ACE Practice Question: What action does the condition in the IAM policy…

Exhibit

Refer to the exhibit.

{
  "bindings": [
    {
      "role": "roles/compute.admin",
      "members": ["user:admin@example.com"],
      "condition": {
        "title": "limit_to_disk_actions",
        "expression": "resource.name.startsWith(\"projects/my-project/zones/us-central1-a/disks/disk-\")"
      }
    }
  ]
}

What action does the condition in the IAM policy restrict the user from performing?

⚠ Common exam trap

The trap is that the question asks 'what action does the condition restrict the user from performing?' Many candidates mistakenly select the allowed action (option C) instead of the restricted action (option A). The condition explicitly permits an action, so the restricted action is the complement of what is allowed.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Deleting disks that do not start with 'disk-'

The condition in the IAM policy restricts the user from performing actions on disks that do not meet the specified criteria. Specifically, the condition `resource.name.startsWith('disk-')` combined with the zone constraint `us-central1-a` means that only disks whose names start with 'disk-' in that zone are allowed for the granted action (e.g., `compute.disks.delete`). Therefore, the policy restricts the user from deleting disks that do not start with 'disk-'. Option A correctly identifies this restricted action.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Deleting disks that do not start with 'disk-'
Why this is correct
The IAM policy grants the compute.disks.delete permission only when the condition `resource.name.startsWith('disk-')` evaluates to true. For a disk with a name that does not begin with 'disk-', the condition fails and the delete request is implicitly denied. This means the effect is exactly restricting deletion only to disks with the 'disk-' prefix, so any disk not matching that prefix cannot be deleted. That is the action the condition restricts.
✗
Performing any action on compute instances
Why it's wrong here
The condition is scoped to disk resources, not compute instances. IAM condition expressions are evaluated against the resource that the request targets; a condition that references disk names (e.g., resource.name.startsWith('disk-')) is meaningless for compute.instances.* methods, which use a different resource type and name format. Therefore, this condition does not restrict any action on compute instances.
✗
Performing any compute.admin action on disks in us-central1-a with names starting with 'disk-'
Why it's wrong here
This option describes the action that the condition allows, not what it restricts. The condition permits deletion of disks whose names start with 'disk-' (and possibly only in that zone, if the zone is also part of the condition), but it does not grant 'any compute.admin action'—it only applies to specific disk permissions like delete. Since the question asks for the restricted action, this is the opposite: the restriction is on deleting disks that do not start with 'disk-'.
✗
Creating disks in any zone other than us-central1-a
Why it's wrong here
This condition restricts deletion, not creation; compute.disks.create is a separate permission that would need its own condition. The condition attribute is resource.name, not zone; even if the zone were us-central1-a, the key constraint is the disk name prefix 'disk-', so disks in any zone that lack the prefix would still have delete denied. Also, condition expressions cannot directly filter on zone for disk delete unless explicitly using resource.zone, which is not described here.

Go deeper

Google ACE Practice Question: What action does the condition in the IAM policy…

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question