After a service account's key surfaced in a public repository, responders must list every project, folder, and bucket that the identity can reach, including access inherited from higher levels. Which tool gives them that view?
Show answer and explanation
Answer: D
IAM Policy Analyzer answers questions about effective access, including which resources a given identity can reach across the organization. It evaluates allow policies at every level of the hierarchy, so inherited grants are included. That makes it well suited to scoping a compromised account. Its results guide containment, such as removing bindings or disabling the identity, and they help confirm the full extent of exposure before the investigation closes.
Why the other options are wrong
- A. IAM Recommender suggests removing permissions that have not been used recently. It is useful for right-sizing access but does not enumerate reachable resources during an incident.
- B. A raw inventory export lists policies and resources, but working out effective reach from it means manual joins across bindings and levels. It is slower and easy to get wrong during an incident.
- C. Policy Troubleshooter explains why one specific principal is allowed or denied one permission on one resource. It answers a single question at a time rather than mapping the entire footprint.
Exam tip. For blast-radius questions think Policy Analyzer; for why-was-this-denied questions think Troubleshooter.