[Solved] Which statement best describes the scope of an IAM deny policy in Google Cloud? — Ans: It applies to all resources in the project and below. | GCP

GCP - Cloud IAM Advanced

Which statement best describes the scope of an IAM deny policy in Google Cloud?

AIt applies only to the specific resource where it is set.

BIt applies to all resources in the project and below.

CIt applies globally across all Google Cloud projects.

DIt applies only to users in the same organization.

Step-by-Step Solution

Solution:

Step 1: Understand deny policy inheritance
Deny policies set at a project level apply to that project and all resources within it.
Step 2: Clarify scope limits
Deny policies do not apply globally or only to specific users but to all identities accessing the resources under the scope.
Final Answer:
It applies to all resources in the project and below. -> Option B
Quick Check:
Deny policy scope = Project and resources [OK]

Quick Trick: Deny policies cascade down resource hierarchy [OK]

Common Mistakes:

Master "Cloud IAM Advanced" in GCP

9 interactive learning modes - each teaches the same concept differently

More GCP Quizzes

Which statement best describes the scope of an IAM deny policy in Google Cloud?