[Solved] Given this deny policy snippet:{"rules": [{"deniedPermissions": ["compute.instances.delete"]}]}If a user has an allow policy for "compute.instances.... | GCP

GCP - Cloud IAM Advanced

Given this deny policy snippet:

{"rules": [{"deniedPermissions": ["compute.instances.delete"]}]}

If a user has an allow policy for "compute.instances.delete", what will happen when they try to delete an instance?

AThe delete action will be denied due to the deny policy.

BThe delete action will be allowed because allow policies override deny policies.

CThe delete action will be allowed only if the user is an admin.

DThe delete action will be logged but not blocked.

Step-by-Step Solution

Solution:

Step 1: Analyze deny policy effect on permission
The deny policy explicitly blocks "compute.instances.delete" permission.
Step 2: Understand policy precedence
Deny policies override allow policies, so the user cannot delete instances despite allow.
Final Answer:
The delete action will be denied due to the deny policy. -> Option A
Quick Check:
Deny overrides allow = Deny action [OK]

Quick Trick: Deny always blocks action even if allowed elsewhere [OK]

Common Mistakes:

Master "Cloud IAM Advanced" in GCP

9 interactive learning modes - each teaches the same concept differently

More GCP Quizzes

Given this deny policy snippet: