Google ACE Configuring Access and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  gcloud compute instances get-iam-policy [INSTANCE]

  Why it's wrong here

  This command fetches the IAM policy bound to a specific Compute Engine instance. While it shows permissions for actions on that individual resource, it does not reveal the project-level IAM policy that governs all resources in the project. IAM policies are hierarchical; the instance policy is a subset of resource-level bindings, not the project-wide configuration.

• ✗

  gcloud organizations get-iam-policy [ORG_ID]

  Why it's wrong here

  This command retrieves the IAM policy at the organization node, which is the root resource in the GCP hierarchy. The organization policy applies to all projects under that org, but it is distinct from the specific project's IAM policy. The user must have Organization Administrator or appropriate roles, and it does not answer the question about a specific project.

• ✓

  gcloud projects get-iam-policy [PROJECT_ID] --format json

  Why this is correct

  This command correctly retrieves the IAM policy for the specified GCP project, including all role bindings for members at the project level. The --format json flag ensures the output is machine-readable JSON, which is useful for automation or programmatic inspection. It is the standard gcloud command for viewing project-level IAM policies.

• ✗

  gcloud iam service-accounts get-iam-policy [SERVICE_ACCOUNT]

  Why it's wrong here

  This command gets the IAM policy for a specific service account, which defines who can act as or impersonate that service account. It is a resource-level policy, completely separate from the project-level IAM policy. Therefore, it does not show the project-wide permissions that the question is asking for.

Go deeper

Related to this question