Why IAM is foundational in GCP - Test Your Understanding

Practice - 5 Tasks

1fill in blank

easy

Complete the code to assign a role to a user in GCP IAM.

GCP

gcloud projects add-iam-policy-binding my-project --member='user:[e-mail]' --role=[1]

Drag options to blanks, or click blank then click option'

Aroles/storage.admin

Broles/viewer

Croles/owner

Droles/editor

Attempts:

3 left

💡 Hint

Common Mistakes

Choosing roles/owner grants too many permissions.

Using roles/storage.admin is specific to storage only.

The roles/viewer role grants read-only access, which is a common starting point for IAM permissions.

2fill in blank

medium

Complete the code to list IAM policies for a project.

GCP

gcloud projects get-iam-policy my-project --format=[1]

Drag options to blanks, or click blank then click option'

Atable

Byaml

Ctext

Djson

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'table' or 'text' formats which are less structured.

Choosing 'yaml' which is valid but less common for IAM policies.

The json format is commonly used to view IAM policies in a structured way.

3fill in blank

hard

Fix the error in the command to remove a role binding from a user.

GCP

gcloud projects remove-iam-policy-binding my-project --member=[1] --role=roles/editor

Drag options to blanks, or click blank then click option'

Auser:[e-mail]

[e-mail]

Cuser [e-mail]

Duser=[e-mail]

Attempts:

3 left

💡 Hint

Common Mistakes

Omitting 'user:' prefix causes errors.

Using '=' or spaces instead of ':'.

The member must be specified with the prefix user: to identify the type correctly.

4fill in blank

hard

Fill both blanks to create a custom IAM role with permissions.

GCP

gcloud iam roles create myCustomRole --project=my-project --title='Custom Role' --permissions=[1] --stage=[2]

Drag options to blanks, or click blank then click option'

Acompute.instances.get,storage.buckets.list

Bstorage.objects.create,storage.objects.delete

CGA

DBETA

Attempts:

3 left

💡 Hint

Common Mistakes

Using permissions unrelated to the task.

Choosing 'BETA' stage for a stable role.

Custom roles require a comma-separated list of permissions and a valid stage like GA (General Availability).

5fill in blank

hard

Fill all three blanks to grant a service account access to a BigQuery dataset.

GCP

gcloud projects add-iam-policy-binding my-project --member=[1] --role=[2] --condition=true --condition-title=[3]

Drag options to blanks, or click blank then click option'

AserviceAccount:[e-mail]

Broles/bigquery.dataViewer

C"Access BigQuery Dataset"

Duser:[e-mail]

Attempts:

3 left

💡 Hint

Common Mistakes

Using a user instead of a service account.

Choosing a role with too many permissions.

Omitting quotes around the condition title.

The service account is specified with the serviceAccount: prefix, the role roles/bigquery.dataViewer grants read access, and the condition title is a descriptive string.