GCP ACE · Question 44 · Domain 5.1: Managing Identity and Access Management (IAM)
A user is assigned the roles/editor (Project Editor) role at the Folder level. However, at the Project level (for a project inside that folder), the same user is explicitly assigned only the roles/compute.viewer role.
What level of access does this user have to the Compute Engine instances in that project?
Answer options:
They have full Editor access (can modify instances) because IAM permissions are inherited and additive.
They have only Viewer access because the most restrictive policy applies.
They have only Viewer access because project-level policies override folder-level policies.
They have no access because the conflicting roles cause a denial of access.
50 questions · hints · full answers · grading
Expert