Your company is using Google Cloud. You have two folders under the Organization: Finance and Shopping. The members of the development team are in a Google Group. The development team group has been as

Question

Options

• AAssign the development team group the Project Viewer role on the Finance folder, and assign the
• BAssign the development team group only the Project Viewer role on the Finance folder.
• CAssign the development team group the Project Owner role on the Shopping folder, and remove
• DAssign the development team group only the Project Owner role on the Shopping folder.

• A
  7% (3)
• B
  5% (2)
• C
  75% (33)
• D
  14% (6)

Explanation

Option C is correct because in Google Cloud IAM, permissions are inherited down the hierarchy and there is no built-in "deny" - a higher-level role always wins. Since the development team currently holds Project Owner at the Organization level, that permission cascades into both Finance and Shopping; the only way to block access to Finance is to remove the org-level role and re-grant Project Owner specifically on the Shopping folder, which is exactly what option C does.

Options A and B are wrong for the same reason: assigning Project Viewer on the Finance folder does nothing when the team already inherits Project Owner from the Organization - the higher role overrides the lower one, so they can still create resources in Finance.

Option D is wrong because it adds Project Owner on Shopping but never removes the existing Organization-level Project Owner, leaving the team's inherited access to Finance fully intact.

Memory tip: Think of GCP IAM like water flowing downhill - permissions flow from Organization → Folder → Project, and you can't build a dam mid-stream by adding a weaker role below. To restrict access, you must cut the pipe at the source (remove the higher-level role) and redirect it only where you want it.

No community discussion yet for this question.