Google ACE Configuring Access and Security Practice Question
You want to view the current IAM policy for a project in JSON format using the gcloud command-line tool. Which command should you run?
⚠ Common exam trap
ACE often tests the confusion between commands for different resources (project vs. service account) and invalid command syntax like 'gcloud iam policies get'.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
gcloud projects get-iam-policy <project-id> --format json
The command 'gcloud projects get-iam-policy <project-id> --format json' retrieves the IAM policy for a project in JSON format. This command directly fetches the policy bindings and audit configs for the specified project.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
gcloud projects get-iam-policy <project-id> --format json
Why this is correct
This is the correct command. `gcloud projects get-iam-policy` invokes the Cloud Resource Manager `getIamPolicy` API for the specified project, and the `--format json` flag requests the output as a structured JSON object containing the policy's `etag`, `version`, and `bindings`. It is the standard way to view all project-level IAM bindings.
- ✗
gcloud iam service-accounts get-iam-policy <service-account> --format json
Why it's wrong here
This command is incorrect because it retrieves the IAM policy that governs who can use a specific service account, not the project's overall IAM policy. The resource type is a service account (identified by email or ID), and the returned policy lists principals with roles on that service account. Passing a project-id would be misinterpreted as a service account identifier, causing an error or an unrelated policy.
- ✗
gcloud iam policies get <project-id> --format json
Why it's wrong here
`gcloud iam policies get` is a generic command for resources that lack a dedicated IAM subcommand, such as organizations or folders; it expects a `--resource` flag with the full resource name. Projects, however, have their own dedicated `get-iam-policy` subcommand under `gcloud projects`, so this generic path is invalid or will not return the project's IAM policy.
- ✗
gcloud projects describe <project-id> --format json
Why it's wrong here
`gcloud projects describe` calls the Cloud Resource Manager `get` method to return the project's metadata (e.g., name, project ID, project number, labels, lifecycle state). It does not contact the IAM `getIamPolicy` endpoint, so even with `--format json` it outputs only project attributes, not the IAM bindings that define access control.
Go deeper
Related to this question
Learn chapter
Security Command Center (SCC)
Key term
IAM policy
An IAM policy is a set of rules that determines who can access specific cloud resources and what actions they are allowed to perform.
Key term
IAM
Identity and Access Management (IAM) is a framework of policies and technologies that ensures the right individuals have the appropriate access to technology resources.
About these practice questions
This ACE question is part of Courseiva's 775-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Google Cloud exam blueprint
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.