mediumMultiple ChoiceObjective-mapped
Google ACE Practice Question: Your organization has multiple GCP projects and…
Your organization has multiple GCP projects and wants to implement least privilege access for operations teams. Each operations team manages a specific set of projects. You have created custom roles that grant permissions to start and stop Compute Engine instances, view logs, and monitor resources. You are using Google Groups to assign roles to users. Recently, a user from the network operations team was able to modify firewall rules in a project managed by the compute operations team, causing a security incident. During the root cause analysis, you discover that the user is a member of both the network operations group and the compute operations group. The compute operations group is assigned a custom role that does not include firewall permissions. The network operations group is assigned a role that includes firewall admin permissions. How should you redesign the IAM structure to prevent cross-team access while maintaining required permissions?
⚠ Common exam trap
Candidates often think removing the user from the group (Option D) or using organization policies (Option C) solves the problem, but they fail to recognize that IAM conditions can scope permissions to specific projects or resources without altering group membership or applying blanket restrictions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use IAM conditions to restrict the network operations role to only the network team's projects.
IAM conditions allow you to restrict the network operations team's firewall admin permissions to only their designated projects, preventing a user who is a member of both groups from using those permissions in the compute operations team's projects. This enforces least privilege by scoping the role's effectiveness based on resource attributes, without requiring project-level separation or removing the user from necessary groups.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a separate project for each team and use VPC Service Controls to isolate.
Why it's wrong here
Creating a separate project per team and applying VPC Service Controls does not address the root cause: the user remains a member of a network operations group that has a role binding spanning multiple projects. VPC Service Controls enforces data exfiltration boundaries via service perimeters, not IAM authorization scoping, and it cannot restrict which projects a given IAM principal may act in. Restructuring projects adds complexity and creates new IAM management overhead without limiting the over-broad role assignment that already exists.
- ✓
Use IAM conditions to restrict the network operations role to only the network team's projects.
Why this is correct
Use IAM conditions to restrict the network operations role to only the network team's projects. In the IAM policy binding that grants the role to the network operations group, add a condition using Common Expression Language (CEL), such as resource.name.startsWith("projects/network-team-project") or resource.tag for a specific project tag. This ensures the role is only effective when the request targets resources within the allowed projects, directly preventing the user from using the role in unrelated projects while preserving legitimate access.
- ✗
Implement organization policies to deny firewall modifications unless a specific condition is met.
Why it's wrong here
Organization policies are designed to enforce constraints across projects at the organization or folder level, such as disabling service accounts or restricting certain services; they cannot evaluate the identity or group membership of the caller in a way that would limit a role to particular projects. Even if you implement a policy that denies firewall modifications unless a condition is met, that policy applies globally to all principals, blocking legitimate network operations in the correct projects as well. This approach does not invalidate the user's broad IAM role; it just adds a global restriction that fails to address the actual scoping problem.
- ✗
Remove the user from the network operations group.
Why it's wrong here
Removing the user from the network operations group is a blunt, short-term fix that immediately revokes access to all projects where the group role is bound, including legitimate network operations duties. This does not resolve the underlying issue that the group itself is over-scoped across projects; the same conflict would resurface if another user is added to the group, and it leaves the IAM binding misconfigured. It may also be impossible if the user is a group owner or the group is managed outside your control, so it is not a reliable administrative solution.
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
IAM
Identity and Access Management (IAM) is a framework of policies and technologies that ensures the right individuals have the appropriate access to technology resources.
Key term
Custom role
A custom role is a user-defined set of permissions in Google Cloud that you can tailor to fit specific job functions beyond the predefined roles.
About these practice questions
One of 769 original ACE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.