GCP ACE · Question 42 · Domain 5.1: Managing Identity and Access Management (IAM)
A user named Alice belongs to the 'Developers' Google Group. The 'Developers' group is granted the 'Compute Viewer' role at the Folder level. Alice is also individually granted the 'Compute Admin' role at the Project level (which is inside the Folder).
Which TWO statements are true regarding Alice's permissions on instances in the Project? (Select TWO)
Answer options:
Alice only has 'Compute Viewer' rights because Folder-level permissions override Project-level permissions.
Alice can delete Compute Engine instances in the project.
IAM policies are a union of those granted at the resource level and those inherited from higher levels.
Alice's individual role assignment is invalid because she is already in a group with a role on the same resource tree.
Alice must use a Service Account to exercise her 'Compute Admin' rights.
50 questions · hints · full answers · grading
Expert