ExpertHard1 markMultiple Choice
GCP ACE · Question 44 · Domain 5.1: Managing Identity and Access Management (IAM)
You are conducting a security audit and need to view the complete list of IAM role assignments (bindings) for a project named 'finance-prod-99'.
Which gcloud command should you use?
You are conducting a security audit and need to view the complete list of IAM role assignments (bindings) for a project named 'finance-prod-99'.
Which gcloud command should you use?
Answer options:
A.
gcloud iam roles list --project=finance-prod-99
B.
gcloud projects get-iam-policy finance-prod-99
C.
gcloud compute project-info describe finance-prod-99
D.
gcloud projects describe finance-prod-99 --show-iam
How to approach this question
Remember that IAM assignments are stored in a 'policy'. You need to 'get' the 'policy' for the 'project'.
Full Answer
B.gcloud projects get-iam-policy finance-prod-99✓ Correct
In Google Cloud, IAM role assignments are stored in an IAM Policy attached to a resource. To view who has access to a project, you must retrieve the project's IAM policy. The correct command is `gcloud projects get-iam-policy [PROJECT_ID]`. This outputs a list of bindings, where each binding shows a role and the members (users, groups, service accounts) assigned to that role.
Common mistakes
Choosing `gcloud iam roles list`, which just lists the definitions of roles, not who they are assigned to.
Practice the full GCP Associate Cloud Engineer Practice Exam 6
50 questions · hints · full answers · grading
More questions from this exam
Q01What is the primary purpose of a Google Cloud project?EasyQ02Your development team needs to manage Compute Engine instances in a specific project. They need t...MediumQ03You are automating the setup of a new Google Cloud project using a bash script. You need to enabl...EasyQ04Your startup has a strict monthly cloud budget of $500. You want to be notified immediately if yo...MediumQ05Your finance team wants to perform granular analysis of your Google Cloud spending using SQL. The...Hard