nerdexam
Google

ASSOCIATE-CLOUD-ENGINEER · Question #318

You are in charge of provisioning access for all Google Cloud users in your organization. Your company recently acquired a startup company that has their own Google Cloud organization. You need to…

The correct answer is C. Use the gcloud iam roles copy command, and provide the Organization ID of the startup. To apply the same custom project permissions to SREs across two Google Cloud organizations, use the gcloud iam roles copy command to copy the custom role from your organization to the startup company's organization, which ensures consistent permissions.

Submitted by saadiq_pk· Mar 30, 2026Configuring access and security

Question

You are in charge of provisioning access for all Google Cloud users in your organization. Your company recently acquired a startup company that has their own Google Cloud organization. You need to ensure that your Site Reliability Engineers (SREs) have the same project permissions in the startup company's organization as in your own organization. What should you do?

Options

  • AIn the Google Cloud console for your organization, select Create role from selection, and choose
  • BIn the Google Cloud console for the startup company, select Create role from selection and
  • CUse the gcloud iam roles copy command, and provide the Organization ID of the startup
  • DUse the gcloud iam roles copy command, and provide the project IDs of all projects in the startup

How the community answered

(25 responses)
  • A
    4% (1)
  • B
    16% (4)
  • C
    76% (19)
  • D
    4% (1)

Why each option

To apply the same custom project permissions to SREs across two Google Cloud organizations, use the `gcloud iam roles copy` command to copy the custom role from your organization to the startup company's organization, which ensures consistent permissions.

AIn the Google Cloud console for your organization, select Create role from selection, and choose

The "Create role from selection" option in the Google Cloud console creates a new role *within* the current organization or project but does not facilitate copying an existing custom role to a different organization.

BIn the Google Cloud console for the startup company, select Create role from selection and

Similar to option A, using "Create role from selection" in the startup company's console would create a new role there, but it doesn't allow for copying an existing custom role definition from a different organization directly.

CUse the gcloud iam roles copy command, and provide the Organization ID of the startupCorrect

The `gcloud iam roles copy` command is specifically designed to copy custom roles from one organization to another. By copying the organization-level custom role from your company's organization to the startup's organization, you ensure that the SREs can be granted the exact same set of permissions in the new organization.

DUse the gcloud iam roles copy command, and provide the project IDs of all projects in the startup

While `gcloud iam roles copy` is the correct command, providing project IDs would copy project-level custom roles, whereas the requirement is to manage organization-level permissions for SREs to apply across projects, implying an organization-level custom role copy.

Concept tested: Copying custom IAM roles between organizations

Source: https://cloud.google.com/iam/docs/creating-custom-roles#copy-custom-role

Topics

#IAM role copy#cross-organization#gcloud CLI#SRE access management

Community Discussion

No community discussion yet for this question.

Full ASSOCIATE-CLOUD-ENGINEER Practice