Examkin

Question

Difficulty: MediumManaging Cloud Projects and Resource Hierarchy

Your organization structures its Google Cloud resources using a resource hierarchy where the Finance department operates within a dedicated folder containing several workload projects. A compliance auditor requires read-only permissions to inspect configuration settings across all current projects within the Finance folder, as well as any new projects created inside this folder in the future. Following Google Cloud recommended practices and the principle of least privilege, which action should you take?

  1. Grant the predefined Security Reviewer role (roles/iam.securityReviewer) on the Finance folder.Answer
  2. B
    Grant the primitive Owner role (roles/owner) on the Finance folder.
  3. C
    Grant the Security Reviewer role (roles/iam.securityReviewer) individually on each project currently inside the folder.
  4. D
    Grant the Billing Account Viewer role (roles/billing.viewer) on the Organization node.

Answer

Grant the predefined Security Reviewer role (roles/iam.securityReviewer) on the Finance folder.
In Google Cloud's resource hierarchy, IAM policies applied at a parent container (such as a folder) are automatically inherited by all child resources, including existing and future projects. Binding the predefined Security Reviewer role at the Finance folder level fulfills the auditing access requirement dynamically while strictly adhering to the principle of least privilege.

Step-by-Step Solution

1
Determine the appropriate level in the resource hierarchy for access binding.
Select the Finance folder level.
IAM policies set at the folder level automatically inherit to all present and future child projects within that folder.
2
Select an IAM role that satisfies the auditing requirement under least privilege.
Select the predefined Security Reviewer role (roles/iam.securityReviewer).
Predefined roles provide narrow permissions focused on viewing security configurations without giving unnecessary edit or administrative powers.

Key Concept

Resource Hierarchy IAM Policy Inheritance and Predefined Roles
Rate this question

Topics

Managing Cloud Projects and Resource Hierarchy

More questions from this topic