Examkin

Question

Difficulty: MediumManaging IAM Roles and Resource Access Permissions

A compliance auditor requires read-only access to query and analyze BigQuery dataset contents across all Google Cloud projects contained within a specific organizational folder. The auditor should not have access to manage project configurations or read data from other GCP services. To adhere to the principle of least privilege while minimizing management overhead, which IAM role configuration should you implement?

  1. Grant the BigQuery Data Viewer role (`roles/bigquery.dataViewer`) to the auditor at the Folder resource level.Answer
  2. B
    Grant the primitive Viewer role (`roles/viewer`) to the auditor at the Folder resource level.
  3. C
    Grant the BigQuery Data Viewer role (`roles/bigquery.dataViewer`) at the Organization level and apply a Deny policy on other folders.
  4. D
    Grant the Billing Account Viewer role (`roles/billing.viewer`) to the auditor at the Folder resource level.

Answer

Grant the BigQuery Data Viewer role (`roles/bigquery.dataViewer`) to the auditor at the Folder resource level.
Granting the predefined BigQuery Data Viewer role (`roles/bigquery.dataViewer`) at the Folder level leverages IAM policy inheritance down the resource hierarchy. All current and future projects under that folder will inherit this role, granting the auditor read-only access to BigQuery dataset contents while enforcing the principle of least privilege.

Step-by-Step Solution

1
Identify the target resource boundary
The requirement specifies access across all projects within a specific organizational folder.
IAM permissions granted at a parent node in the resource hierarchy (Folder) are automatically inherited by child nodes (Projects).
2
Select the appropriate role based on least privilege
Choose `roles/bigquery.dataViewer` over primitive or administrative roles.
The auditor only needs to read dataset contents within BigQuery, so a predefined role tailored specifically to BigQuery data viewing enforces least privilege.
3
Bind the role to the auditor at the Folder level
The auditor gains automatic read-only access to all present and future BigQuery datasets inside all projects under that folder.
This minimizes administrative effort by avoiding individual project-level bindings while restricting scope.

Key Concept

Resource hierarchy inheritance and predefined role selection for IAM access control
Estimated Time:1m 30s
Rate this question

Topics

Managing IAM Roles and Resource Access Permissions

More questions from this topic