hardMultiple ChoiceObjective-mapped
IAM Deny Policies Override Allow Policies
A security engineer is troubleshooting access to a Cloud Storage bucket. The bucket has uniform bucket-level access enabled. The engineer's user account has the roles/storage.objectViewer role at the project level, but they get a 403 error when trying to download an object. What is the most likely cause?
Quick Answer
The answer is that a deny rule in an Organization Policy or an IAM deny policy is the most likely cause, because IAM deny policies override allow policies explicitly, regardless of any granted roles. Even though the user holds the roles/storage.objectViewer role at the project level, which normally grants read access, a deny rule takes precedence and blocks the operation, resulting in a 403 error. This scenario tests your understanding of the fundamental IAM evaluation hierarchy on the Google Professional Cloud Security Engineer exam, where deny rules are always evaluated last and supersede any allow permissions. A common trap is assuming that uniform bucket-level access alone causes the issue, but it only disables ACLs—it does not affect IAM deny policies. Remember the key principle: deny always wins. For the exam, keep the memory tip "Deny Defeats All" to recall that any explicit deny rule will override all allow permissions, no matter how broad.
⚠ Common exam trap
Google Cloud often tests the nuance that deny policies (IAM deny or Organization Policy) override allow policies, leading candidates to incorrectly assume that having the correct IAM role is sufficient for access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
There is a deny rule in an Organization Policy or an IAM deny policy that blocks the user.
Uniform bucket-level access disables ACLs, so access is governed solely by IAM and organization policies. A deny rule in an Organization Policy or an IAM deny policy explicitly overrides any allow permissions, causing a 403 error even if the user has the roles/storage.objectViewer role at the project level. This is the most likely cause given that the user already has the necessary IAM role.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The bucket has ACLs that override the IAM role.
Why it's wrong here
Uniform bucket-level access disables ACLs.
- ✗
The user does not have the storage.objects.get permission.
Why it's wrong here
roles/storage.objectViewer includes storage.objects.get.
- ✗
The user's project-level role does not apply to this specific bucket.
Why it's wrong here
Project-level roles apply to all resources in the project.
- ✓
There is a deny rule in an Organization Policy or an IAM deny policy that blocks the user.
Why this is correct
Deny rules take precedence over allow rules, causing the 403 error.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCSE question from scratch — 960 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on PCSE
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security team wants to explicitly deny access to a Cloud Storage bucket for all users except the bucket owner. Currently, there are allow policies at the project level granting Storage Object Viewer to all users. What is the most efficient way to implement this?
medium- A.Create an Organization Policy that denies access to the bucket for all users except the owner.
- B.Modify the project-level role to include a condition that only allows the bucket owner.
- C.Remove the project-level Storage Object Viewer role and grant it only to the bucket owner.
- ✓ D.Create an IAM deny policy on the bucket with a deny rule for all principals (principalSet: allUsers) and an exception for the bucket owner.
Why D: Google Cloud IAM deny policies explicitly deny access to resources, overriding any allow policies. By creating a deny rule on the bucket with `principalSet: allUsers` as the denied principal and an exception for the bucket owner, you effectively block all users except the owner, regardless of project-level allow roles. This is the most efficient approach as it does not require modifying existing project-level policies or removing roles.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.