Iam Deny Policy Hierarchy Inheritance 2

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise organization contains a folder named Core-Infrastructure, which contains a child project named network-prod. A cloud engineer who is a member of the Google Group ops-engineers@example.com is granted the Project Deleter role (roles/resourcemanager.projectDeleter) directly on the network-prod project. To prevent accidental resource deletion, a security administrator attaches an IAM deny policy to the Core-Infrastructure folder that specifies principalSet://goog/group/ops-engineers@example.com in deniedPrincipals and cloudresourcemanager.googleapis.com/projects.delete in deniedPermissions.

What is the result when this engineer attempts to delete the network-prod project, and how does IAM evaluate the request?

The deletion request is allowed because IAM merges allow and deny rules into a net-positive permission set when there is an explicit role binding on the target resource.

The deletion request is denied only if the project also enforces an Organization Policy constraint blocking project deletion.

The deletion request is denied because IAM evaluates inherited deny policies prior to allow policies, and child allow grants cannot override parent deny rules.

The deletion request is allowed because IAM allow policies bound directly to a child project override deny policies inherited from ancestor folders.

Professional Cloud Security Engineer

Iam Deny Policy Hierarchy Inheritance 2

Related questions