4.1 Managing IAM ASSOCIATE-CLOUD-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   You created a custom IAM role named 'custom.bucketManager' and granted it to a group of users in your project. After a security review, you realize that the role includes the permission 'storage.buckets.delete', which should not be granted. You need to remove this permission from the role immediately. What is the impact on the users who currently have this role?

   • AUsers will retain the 'storage.buckets.delete' permission until the role is deleted and recreated.
   • BUsers will immediately lose the 'storage.buckets.delete' permission, but will retain all other permissions in the role.
   • CUsers will lose all permissions in the role and must be re-granted the role after the update.
   • DUsers will lose the 'storage.buckets.delete' permission, but only after they re-authenticate.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What happens to the permissions of a member who has a custom role that is disabled?

   • AThe member loses all permissions granted by that role.
   • BThe member retains the permissions but they are marked as inactive.
   • CThe member retains the permissions but cannot be assigned the role to others.
   • DThe member retains the permissions until the role is deleted.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   You are reviewing the IAM policy for a project and see the following JSON: ```json { "bindings": [ { "role": "roles/compute.instanceAdmin", "members": [ "serviceAccount:sa-prod@project.iam.gserviceaccount.com" ] }, { "role": "roles/viewer", "members": [ "user:alice@example.com" ] } ] } ``` What can the service account 'sa-prod' do?

   • AIt can fully manage Compute Engine instances, including creating, deleting, and modifying them.
   • BIt can manage Compute Engine instances and also view all other resources in the project.
   • CIt can view all resources in the project, including Compute Engine instances.
   • DIt can only view Compute Engine instances, but not modify them.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which gcloud command displays the IAM policy for a Compute Engine instance named 'my-vm' in the default zone?

   • Agcloud compute instances list-iam-policy my-vm
   • Bgcloud iam policies get my-vm
   • Cgcloud compute instances get-iam-policy my-vm
   • Dgcloud compute instances describe my-vm --iam-policy
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which statement accurately describes a predefined IAM role?

   • AIt is a role that can only be used at the organization level.
   • BIt is a role created by an administrator to fit specific needs.
   • CIt is a role that grants broad permissions across all services, such as Owner or Editor.
   • DIt is a Google-created role that grants fine-grained permissions for a specific service.
   Reveal Solution Discussion Select an answer first