Access control (IAM vs ACLs) in GCP - Practice Questions

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding IAM vs ACLs in GCP

Which statement correctly describes the difference between IAM and ACLs in Google Cloud Platform?

A ACLs replace IAM roles and are the recommended way to manage permissions across all GCP services.

B IAM controls access at the project or resource level using roles, while ACLs control access at the individual object level, such as files in Cloud Storage.

C IAM is used only for network security, while ACLs manage user permissions for all resources.

D IAM and ACLs are identical and can be used interchangeably for all GCP resources.

💡 Hint

Think about the scope of control each method provides.

IAM provides role-based access control at the project or resource level, while ACLs are more granular and often used for individual objects like files in Cloud Storage.

❓ Architecture

intermediate

Choosing Access Control for Cloud Storage

You want to allow a specific user to read only one file in a Cloud Storage bucket without giving access to the entire bucket. Which access control method should you use?

A Assign an IAM role with read permission on the entire bucket to the user.

B Use IAM to grant the user owner permissions on the project.

C Create a new project and move the file there to isolate access.

D Use an ACL to grant read permission on the specific file to the user.

💡 Hint

Consider the granularity of permissions needed.

ACLs allow you to set permissions on individual objects like files, so you can grant read access to just one file without exposing the whole bucket.

❓ security

advanced

Impact of Overly Broad IAM Roles

What is the most likely security risk if a user is granted the 'Owner' IAM role on a GCP project?

A The user can create, modify, and delete any resource, potentially causing accidental or malicious damage.

B The user can only view resources but cannot make changes.

C The user can only access billing information but not resources.

D The user is restricted to read-only access on all resources.

💡 Hint

Think about what the 'Owner' role allows in GCP.

The 'Owner' role grants full control over all resources in the project, including creating, modifying, and deleting resources, which can lead to security risks if misused.

❓ service_behavior

advanced

Effect of Removing ACLs on Cloud Storage Objects

If you remove all ACL entries from a Cloud Storage object, what will be the effect on access to that object?

A The object becomes publicly accessible to anyone on the internet.

B The object remains accessible to all users who had ACL permissions before removal.

C Only users with IAM permissions on the bucket or project can access the object.

D The object is deleted automatically by Cloud Storage.

💡 Hint

Consider how access is controlled when ACLs are empty.

Without ACLs, access to the object depends on IAM permissions set at the bucket or project level. The object is not public by default.

✅ Best Practice

expert

Best Practice for Managing Access in Large GCP Environments

In a large organization with many teams and projects, what is the best practice for managing access control to ensure security and ease of management?

A Use IAM groups and predefined roles to assign permissions, minimizing direct user assignments and using ACLs only when necessary.

B Assign IAM roles directly to individual users on each project to keep control tight.

C Rely solely on ACLs for all resources to have fine-grained control at the object level.

D Grant all users the Owner role on projects to avoid permission issues.

💡 Hint

Think about scalability and security in large teams.

Using IAM groups and predefined roles simplifies management and improves security by avoiding direct user assignments and limiting ACL use to specific cases.

Practice

1. What is the main difference between IAM and ACLs in Google Cloud Platform?

easy

A. IAM and ACLs are exactly the same in functionality.

B. IAM controls network traffic, and ACLs control user passwords.

C. IAM is only for virtual machines, ACLs are for storage only.

D. IAM manages access at resource levels using roles, while ACLs manage access at object or bucket levels.

Solution

1. Step 1: Understand IAM scope

   IAM controls access broadly by assigning roles to users or groups at resource levels like projects or services.

2. Step 2: Understand ACL scope

   ACLs control access more narrowly, typically at the object or bucket level in storage services.

3. Final Answer:

   IAM manages access at resource levels using roles, while ACLs manage access at object or bucket levels. -> Option D

4. Quick Check:

   IAM = broad roles, ACLs = fine-grained object permissions [OK]

Hint: IAM is broad roles; ACLs are fine-grained permissions [OK]

Common Mistakes:

• Confusing IAM with network controls
• Thinking ACLs control passwords
• Assuming IAM and ACLs are identical

2. Which of the following is the correct way to grant a user the role of 'Storage Object Viewer' using IAM in GCP?

easy

A. Edit the user's password in the IAM console.

B. Add the user to the ACL of the bucket with read permission.

C. Use the command: gcloud projects add-iam-policy-binding my-project --member='user:[e-mail]' --role='roles/storage.objectViewer'

D. Create a firewall rule allowing the user access.

Solution

1. Step 1: Identify IAM command syntax

   The correct gcloud command to grant IAM roles uses 'add-iam-policy-binding' with member and role flags.

2. Step 2: Verify role and member format

   The role 'roles/storage.objectViewer' and member format 'user:[e-mail]' are correct for granting read access to storage objects.

3. Final Answer:

   Use the command: gcloud projects add-iam-policy-binding my-project --member='user:[e-mail]' --role='roles/storage.objectViewer' -> Option C

4. Quick Check:

   IAM role grant uses gcloud add-iam-policy-binding [OK]

Hint: Use gcloud add-iam-policy-binding with correct role and member [OK]

Common Mistakes:

• Confusing ACL changes with IAM commands
• Editing passwords instead of roles
• Using firewall rules for access control

3. Given the following IAM policy snippet for a bucket, what access does the user 'user:[e-mail]' have?

{
  "bindings": [
    {
      "role": "roles/storage.objectAdmin",
      "members": ["user:[e-mail]"]
    }
  ]
}

medium

A. Alice can only read objects in the bucket.

B. Alice can create, delete, and update objects in the bucket.

C. Alice has no access to the bucket.

D. Alice can manage IAM policies but not objects.

Solution

1. Step 1: Identify the role assigned

   The role 'roles/storage.objectAdmin' allows full control over objects in the bucket, including create, delete, and update.

2. Step 2: Confirm member access

   The member 'user:[e-mail]' is assigned this role, so Alice has these permissions.

3. Final Answer:

   Alice can create, delete, and update objects in the bucket. -> Option B

4. Quick Check:

   roles/storage.objectAdmin = full object control [OK]

Hint: objectAdmin role means full object permissions [OK]

Common Mistakes:

• Confusing objectAdmin with read-only roles
• Assuming no access without explicit bucket ACL
• Mixing IAM roles with IAM policy management

4. You tried to grant a user access to a Cloud Storage bucket by adding them to the bucket's ACL, but they still cannot access the objects. What is the likely issue?

medium

A. The bucket has uniform bucket-level access enabled, which disables ACLs.

B. The user needs to restart their computer.

C. The user's email address was misspelled in the ACL.

D. The user was not granted an IAM role at the project level.

Solution

1. Step 1: Understand uniform bucket-level access

   When uniform bucket-level access is enabled, ACLs are disabled and only IAM controls access.

2. Step 2: Check ACL effect

   Adding users to ACLs has no effect if uniform bucket-level access is on, so the user cannot access objects despite ACL changes.

3. Final Answer:

   The bucket has uniform bucket-level access enabled, which disables ACLs. -> Option A

4. Quick Check:

   Uniform bucket-level access disables ACLs [OK]

Hint: Uniform bucket-level access disables ACLs [OK]

Common Mistakes:

• Assuming ACLs always work regardless of bucket settings
• Blaming user typos without verification
• Thinking user restart affects cloud permissions

5. You want to allow a third-party service to read specific objects in your Cloud Storage bucket without giving it full project access. Which approach is best?

hard

A. Add the service account to the bucket's ACL with READER permission on specific objects.

B. Enable uniform bucket-level access and grant the service account the storage.admin role.

C. Grant the service an IAM role at the project level with storage.objectViewer permission.

D. Create a firewall rule to allow the service IP to access the bucket.

Solution

1. Step 1: Understand access scope needs

   The third-party service needs access only to specific objects, not the whole project.

2. Step 2: Choose fine-grained control method

   ACLs allow granting permissions on specific objects or buckets, ideal for limited access.

3. Step 3: Evaluate other options

   IAM roles at project level are too broad; storage.admin is too powerful; firewall rules do not control storage access.

4. Final Answer:

   Add the service account to the bucket's ACL with READER permission on specific objects. -> Option A

5. Quick Check:

   Use ACLs for fine-grained object access [OK]

Hint: Use ACLs for specific object access, IAM for broad access [OK]

Common Mistakes:

• Granting overly broad IAM roles
• Confusing firewall rules with access control
• Using storage.admin role unnecessarily