Home Microsoft Exams Google Cloud Exams Pricing

Loading page

Curious about new developments and updates? Follow our social media.

Get a free certification question every week.

Microsoft Exams

AZ-104 Administrator
AZ-204 Developer
AZ-900 Fundamentals
All Microsoft Exams

Google Cloud Exams

Associate Data Practitioner
All Google Cloud Exams

Features

Readiness assessment
Practice tests
Focused practice
Explanations & AI tutor
Study guides & quizzes

Compare

vs Tutorials Dojo
vs Whizlabs
All comparisons

Terms Privacy CookiesSecurity About Pricing

StudyCerts is an independent service and is not affiliated with, endorsed by, or sponsored by any certification body or cloud provider. All questions and study content are original practice material and are not actual exam questions.

Home
Google Cloud Exams
GCP
Associate Data Practitioner
Section 4: Data Management
IAM Policy Inheritance Hierarchy

Diagram

IAM Policy Inheritance Hierarchy

X LinkedIn Facebook Reddit

A hierarchy showing how IAM roles flow down from the organization through folder and project to BigQuery dataset and table, with a callout that a role granted on a parent applies to all descendants.

In the Domain

IAM Permissions, Roles, and Least Privilege

Identity and Access Management (IAM) is the Google Cloud system that controls which principal can act on which resource. A principal such as a user, Google group, or service account receives a role on a resource, and that role contains permissions. Least privilege means granting only the narrowest role on the narrowest resource that still allows the work.

An IAM permission is the smallest unit of access and allows one specific action. Permissions use the format SERVICE.RESOURCE.VERB, such as compute.instances.list, bigtable.instances.list, or pubsub.topics.publish. Permissions are never assigned directly to a principal in BigQuery. When a principal calls an API, IAM checks whether any granted role contains the required permission, and one data operation can require several permissions.

Read it in the Domain summary

Domain 4 of 4

Section 4: Data Management

Read the Domain summary

Practice this Domain

313 practice questions

Practice this Domain

Last updated October 23, 2026

Domain 4 of 4

Section 4: Data Management

Read the Domain summary

Practice this Domain

313 practice questions

Practice this Domain

Practice questions in this domain

1.A company operates a critical Cloud SQL for PostgreSQL production database and needs to implement a robust data protection strategy. They have the following requirements for their backup solution: Centralized management of backups for multiple Cloud SQL instances across different Google Cloud projects. Long-term retention for compliance, requiring backups to be kept for several years. Granular scheduling for automated backups, allowing for more frequent than daily backups. The ability to perform point-in-time recovery to restore the database to any specific moment. Backups must be protected and recoverable even if the original Cloud SQL instance's project is accidentally deleted. Which Cloud SQL backup option should the company choose to meet these requirements?Compare backup and recovery solutions offered as Google-managed services
2.A data engineering team wants to allow a new team member to upload raw data files to a Google Cloud Storage bucket. Following the principle of least privilege, the team wants to ensure the user receives only the specific capability to write objects (such as storage.objects.create), without gaining unnecessary administrative control or wide access across the entire project. Which statement accurately describes how Google Cloud IAM structures permissions and roles to fulfill this access requirement?Differentiate between basic roles, predefined roles, and permissions for data services (e.g., BigQuery, Cloud Storage)
3.A data analytics team needs to allow a junior data analyst to view and read files within a specific Cloud Storage bucket named sales-reporting-data. The solution must enforce the principle of least privilege by meeting the following constraints: The analyst must only have read access to objects in sales-reporting-data. The analyst must not be able to modify or delete any files or bucket settings. The analyst must not have access to any other buckets or services in the project. Which Identity and Access Management (IAM) configuration should you implement?Differentiate between basic roles, predefined roles, and permissions for data services (e.g., BigQuery, Cloud Storage)
4.A data analytics team is onboarding a new data analyst who needs to run SQL query jobs and view table data in BigQuery within a specific Google Cloud project. The team's security policy requires following the principle of least privilege by avoiding overly permissive access across other Google Cloud resources in the project. Which IAM role approach should the administrator use to grant the required access?Differentiate between basic roles, predefined roles, and permissions for data services (e.g., BigQuery, Cloud Storage)
5.An analytics team in your organization is creating multiple Google Cloud Storage buckets to store raw enterprise datasets. The security compliance team mandates that access permissions must be managed centrally and consistently across all objects within each bucket using Cloud Identity and Access Management (IAM) roles, rather than allowing individual object-level Access Control Lists (ACLs). Which Cloud Storage access control configuration should you implement to satisfy this requirement?Compare methods of access control for Cloud Storage (e.g., public or private access, uniform access)

Loading page

Home
Google Cloud Exams
GCP
Associate Data Practitioner
Section 4: Data Management
IAM Policy Inheritance Hierarchy

Diagram

IAM Policy Inheritance Hierarchy

X LinkedIn Facebook Reddit

In the Domain

IAM Permissions, Roles, and Least Privilege

Identity and Access Management (IAM) is the Google Cloud system that controls which principal can act on which resource. A principal such as a user, Google group, or service account receives a role on a resource, and that role contains permissions. Least privilege means granting only the narrowest role on the narrowest resource that still allows the work.

An IAM permission is the smallest unit of access and allows one specific action. Permissions use the format SERVICE.RESOURCE.VERB, such as compute.instances.list, bigtable.instances.list, or pubsub.topics.publish. Permissions are never assigned directly to a principal in BigQuery. When a principal calls an API, IAM checks whether any granted role contains the required permission, and one data operation can require several permissions.

Read it in the Domain summary

Domain 4 of 4

Section 4: Data Management

Read the Domain summary

Practice this Domain

313 practice questions

Practice this Domain

Last updated October 23, 2026

Domain 4 of 4

Section 4: Data Management

Read the Domain summary

Practice this Domain

313 practice questions

Practice this Domain

Practice questions in this domain

1.A company operates a critical Cloud SQL for PostgreSQL production database and needs to implement a robust data protection strategy. They have the following requirements for their backup solution: Centralized management of backups for multiple Cloud SQL instances across different Google Cloud projects. Long-term retention for compliance, requiring backups to be kept for several years. Granular scheduling for automated backups, allowing for more frequent than daily backups. The ability to perform point-in-time recovery to restore the database to any specific moment. Backups must be protected and recoverable even if the original Cloud SQL instance's project is accidentally deleted. Which Cloud SQL backup option should the company choose to meet these requirements?Compare backup and recovery solutions offered as Google-managed services
2.A data engineering team wants to allow a new team member to upload raw data files to a Google Cloud Storage bucket. Following the principle of least privilege, the team wants to ensure the user receives only the specific capability to write objects (such as storage.objects.create), without gaining unnecessary administrative control or wide access across the entire project. Which statement accurately describes how Google Cloud IAM structures permissions and roles to fulfill this access requirement?Differentiate between basic roles, predefined roles, and permissions for data services (e.g., BigQuery, Cloud Storage)
3.A data analytics team needs to allow a junior data analyst to view and read files within a specific Cloud Storage bucket named sales-reporting-data. The solution must enforce the principle of least privilege by meeting the following constraints: The analyst must only have read access to objects in sales-reporting-data. The analyst must not be able to modify or delete any files or bucket settings. The analyst must not have access to any other buckets or services in the project. Which Identity and Access Management (IAM) configuration should you implement?Differentiate between basic roles, predefined roles, and permissions for data services (e.g., BigQuery, Cloud Storage)
4.A data analytics team is onboarding a new data analyst who needs to run SQL query jobs and view table data in BigQuery within a specific Google Cloud project. The team's security policy requires following the principle of least privilege by avoiding overly permissive access across other Google Cloud resources in the project. Which IAM role approach should the administrator use to grant the required access?Differentiate between basic roles, predefined roles, and permissions for data services (e.g., BigQuery, Cloud Storage)
5.An analytics team in your organization is creating multiple Google Cloud Storage buckets to store raw enterprise datasets. The security compliance team mandates that access permissions must be managed centrally and consistently across all objects within each bucket using Cloud Identity and Access Management (IAM) roles, rather than allowing individual object-level Access Control Lists (ACLs). Which Cloud Storage access control configuration should you implement to satisfy this requirement?Compare methods of access control for Cloud Storage (e.g., public or private access, uniform access)