Objective 1.4
PCSEManaging and implementing authorization controls
Objective 1.4 sits in Configuring access, which carries 25% of the Cloud Security Engineer exam. The questions below are original, written from the official objective title above, and each explanation cites the Google Cloud page it rests on.
Objective title verbatim from the official objectives. Google Cloud exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
A user holds a role granting a permission, and a deny rule names that same permission. Which policy does IAM consult first?
Correct.
Concept
Ordering decides which layer can be overruled. Evaluating the subtractive layer first is what lets a prohibition hold no matter how generously the additive layer is written.
Why C
A denied principal cannot do anything requiring that permission regardless of the roles granted, since IAM always checks relevant deny policies before checking relevant allow policies.
Source
Google Cloud: IAM deny policies, checked August 2026When a principal is denied a permission, they can't do anything that requires that permission, regardless of the IAM roles they've been granted. This is because IAM always checks relevant deny policies before checking relevant allow policies.
Now you: objective 1.4 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
A security team wants a deny rule to cover one Cloud Storage bucket only. Where can the deny policy actually be attached?
Sample question 2 of 3
A deny rule carries a denial condition that references a tag the evaluator cannot read at request time. What is the outcome for the principal?
Sample question 3 of 3
An engineer denies a permission group written as a resource name followed by a wildcard. A new permission on that resource type ships next quarter. What happens?
Full Cloud Security Engineer question bank coming
We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.
Read the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.