Professional Cloud Security Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
An enterprise organization contains a folder named Core-Infrastructure, which contains a child project named network-prod. A cloud engineer who is a member of the Google Group ops-engineers@example.com is granted the Project Deleter role (roles/resourcemanager.projectDeleter) directly on the network-prod project. To prevent accidental resource deletion, a security administrator attaches an IAM deny policy to the Core-Infrastructure folder that specifies principalSet://goog/group/ops-engineers@example.com in deniedPrincipals and cloudresourcemanager.googleapis.com/projects.delete in deniedPermissions.
What is the result when this engineer attempts to delete the network-prod project, and how does IAM evaluate the request?
The deletion request is allowed because IAM allow policies bound directly to a child project override deny policies inherited from ancestor folders.
The deletion request is denied only if the project also enforces an Organization Policy constraint blocking project deletion.
The deletion request is allowed because IAM merges allow and deny rules into a net-positive permission set when there is an explicit role binding on the target resource.
The deletion request is denied because IAM evaluates inherited deny policies prior to allow policies, and child allow grants cannot override parent deny rules.
The deletion request is allowed because IAM allow policies bound directly to a child project override deny policies inherited from ancestor folders.
The deletion request is denied only if the project also enforces an Organization Policy constraint blocking project deletion.
The deletion request is allowed because IAM merges allow and deny rules into a net-positive permission set when there is an explicit role binding on the target resource.
The deletion request is denied because IAM evaluates inherited deny policies prior to allow policies, and child allow grants cannot override parent deny rules.
IAM deny policies provide declarative security guardrails that prevent principals from using specific permissions on Google Cloud resources and all of their descendant resources. Unlike IAM allow policies—which are additive and grant access—deny policies explicitly block access across the resource hierarchy.
When a principal attempts to perform an operation on a Google Cloud resource, IAM performs a structured evaluation across all relevant policy types:
In this scenario, because the Core-Infrastructure folder contains an active deny policy blocking cloudresourcemanager.googleapis.com/projects.delete for ops-engineers@example.com, the deny rule is inherited down to network-prod and halts the evaluation at stage 2.
StudyCerts
StudyCertsroles/resourcemanager.projectDeleter or roles/owner at the project level cannot grant access blocked by a parent deny rule.inheritFromParent: false—IAM deny policies enforce immutable denial across all descendants.