5. Configuring Access and Security
Targeted ACE practice for this exam objective, with an explanation for every answer option.
- Certification
- ACE
- Domain
- 5. Configuring Access and Security
- Questions
- 9
Practice ACE 5. Configuring Access and Security questions with exam-style scenarios, detailed explanations, and option-by-option rationale for this domain.
Example question from this objective
Each option is explained, so the reasoning behind the distractors is part of the answer.
What is a safe reason to run `gcloud projects get-iam-policy PROJECT_ID` before changing IAM bindings?
- To inspect the current policy so you understand existing bindings before making changes.
- To rotate all service account keys automatically.
- To disable billing for users who have project access.
- To delete every inherited organization-level role from the project.
To inspect the current policy so you understand existing bindings before making changes. — `get-iam-policy` reads the current policy and helps avoid accidental removal or duplication of bindings.
To rotate all service account keys automatically. — Service account key rotation is a separate operation.
To disable billing for users who have project access. — Billing configuration is not changed by reading an IAM policy.
To delete every inherited organization-level role from the project. — The command does not delete inherited roles. It reads the project policy.