Professional Cloud Security Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
A security engineer is preparing to remove several broad IAM roles, including roles/editor, from a production project to enforce least privilege across automated workloads. Before applying the updated allow policy, the engineer must validate that the change will not disrupt production services by evaluating the impact against recent historical API access attempts across the project and its child resources.
During an initial command-line test replay, several permissions evaluated to an access state of UNKNOWN_INFO_DENIED with an error indicating missing permissions to retrieve IAM policies.
Which tool should the engineer use, and how should they resolve the evaluation errors?
IAM Policy Simulator is a Policy Intelligence tool that enables administrators and security teams to test and validate proposed changes to IAM allow policies before committing them to production. By replaying recent access logs against a proposed allow policy (or policy overlay), Policy Simulator determines whether principals who previously exercised permissions would retain access (GRANTED), lose access (ACCESS_REVOKED), or potentially experience access changes (ACCESS_MAYBE_REVOKED).
StudyCerts
StudyCertsgcloud iam simulator replay-recent-access command or the Cloud Console Test changes feature, the security engineer can supply a proposed allow policy and compare simulated access states against baseline historical API calls.UNKNOWN_INFO_DENIED errors: When Policy Simulator evaluates effective access, it must inspect the allow policies of ancestor resources (such as parent folders and the organization) as well as descendant resources (such as Cloud Storage buckets or Pub/Sub topics) that appear in the access logs. If the calling identity lacks getIamPolicy permissions (such as resourcemanager.folders.getIamPolicy or storage.buckets.getIamPolicy), the engine cannot evaluate the full hierarchy and returns an UNKNOWN_INFO_DENIED access state. Granting these permissions—or assigning an administrative reader role on a common ancestor resource—allows the simulator to read all relevant policies in the hierarchy.JSON, YAML, or flattened CSV formats for auditing and change management reviews.groups.read) are available.IAM Policy Simulator is specifically architected for batch validation of modified allow policies against historical access patterns, unlike Policy Troubleshooter (which evaluates a single real-time access tuple) or dry-run organization policies (which test constraint violations rather than IAM allow policy bindings).
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.