Manage IAM, including viewing and creating IAM policies, attaching roles and understanding policy inheritance in the organization hierarchy, and managing the various role types and defining custom IAM roles

Manage IAM, including viewing and creating IAM policies, attaching roles and understanding policy inheritance in the organization hierarchy, and managing the various role types and defining custom IAM roles.

Grant access with IAM policies and understand how a binding attached at the organization, folder, or project level is inherited by everything below it, so a role lands at the narrowest scope that satisfies the requirement. Distinguish basic, predefined, and custom roles, and define a custom role when no predefined role fits the principle of least privilege.

IAM policiesPolicy inheritancePredefined rolesCustom rolesLeast privilege

Practice question for this objective

Free sampleConfiguring access and securitymedium

A colleague new to Google Cloud asks how the three IAM role types differ. Which statement correctly characterises basic, predefined, and custom roles?

ABasic roles are granular roles maintained by Google for a single service, predefined roles are the legacy Owner, Editor, and Viewer, and custom roles are copies of basic roles scoped to one project.
BBasic roles are the broad legacy Owner, Editor, and Viewer roles, predefined roles are granular Google-maintained roles for specific services, and custom roles let you assemble a chosen set of permissions. Correct
CBasic roles apply only to Cloud Storage buckets, predefined roles apply only to Compute Engine, and custom roles are the sole way to grant access to any other Google Cloud service.
DBasic roles and predefined roles are both authored by the customer, whereas custom roles are supplied and updated automatically by Google as services change.

Distinguish basic roles as broad legacy roles, predefined roles as granular Google-maintained roles, and custom roles as customer-defined permission sets. IAM offers three role types: basic roles (Owner, Editor, Viewer) grant broad legacy access, predefined roles give granular Google-maintained permissions per service, and custom roles let an administrator combine exactly the permissions a task requires.

Why A is wrong: This swaps the definitions of basic and predefined roles; Owner, Editor, and Viewer are the basic roles, while the granular per-service roles maintained by Google are the predefined ones.

Why B is correct: This matches the model exactly: basic roles are broad and legacy, predefined roles are fine-grained and maintained by Google, and custom roles are built by selecting the specific permissions you want.

Why C is wrong: This invents per-service limits that do not exist; basic and predefined roles both span many services, and custom roles are an option for tailoring permissions rather than the only route to most services.

Why D is wrong: This reverses authorship; basic and predefined roles are provided and maintained by Google, while custom roles are the ones the customer authors and must maintain themselves.

See more GCP-ACE practice questions, answers explained.

Examworthy is not affiliated with or endorsed by Google Cloud. Original, blueprint-aligned practice material only.

Manage IAM, including viewing and creating IAM policies, attaching roles and understanding policy inheritance in the organization hierarchy, and managing the various role types and defining custom IAM roles.

Practice question for this objective

More in this domain