[Solved] Given this deny policy snippet:{"denyRules": [{"deniedPermissions": ["compute.instances.start"]}]}What happens if a user has an allow policy for compute.instances.... | GCP

GCP - Cloud IAM Advanced

Given this deny policy snippet:

{"denyRules": [{"deniedPermissions": ["compute.instances.start"]}]}

What happens if a user has an allow policy for compute.instances.start but this deny policy is applied?

AThe user can start instances because allow policies override deny policies

BThe deny policy has no effect unless combined with a condition

CThe user can start instances only during business hours

DThe user cannot start instances because deny policies block the permission

Step-by-Step Solution

Solution:

Step 1: Understand deny policy precedence and apply to the example
Deny policies always override allow policies for the specified permissions. Even if the user has an allow for starting instances, the deny rule blocks it.
Final Answer:
The user cannot start instances because deny policies block the permission -> Option D
Quick Check:
Deny overrides allow for blocked permissions [OK]

Quick Trick: Deny always beats allow for the same permission [OK]

Common Mistakes:

Master "Cloud IAM Advanced" in GCP

9 interactive learning modes - each teaches the same concept differently

More GCP Quizzes

Given this deny policy snippet: