Examkin

Question

Difficulty: EasyManaging Cloud Projects and Resource Hierarchy

A cloud security auditor requires read-only visibility into all cloud resources contained within a specific business unit's folder. An IT administrator grants the auditor the Viewer role (roles/viewer) directly on that folder. Which statement correctly describes the outcome of this role assignment across the resource hierarchy?

  1. The auditor automatically inherits read-only access to all current and future projects contained within that folder.Answer
  2. B
    The auditor receives read-only access to the folder metadata but must be granted permissions separately on each child project.
  3. C
    The auditor must be assigned the broad primitive Owner role at the Organization level for folder permissions to propagate downward.
  4. D
    The folder-level permission assignment fails because IAM roles can only be granted at the individual project or resource level.

Answer

The auditor automatically inherits read-only access to all current and future projects contained within that folder.
In Google Cloud, IAM policies follow a strict top-down inheritance model across the resource hierarchy (Organization -> Folder -> Project -> Resource). Granting an IAM role at the folder level ensures that any existing or newly created child projects inside that folder automatically inherit the associated permissions.

Step-by-Step Solution

1
Identify the node in the resource hierarchy where the IAM role is granted.
The Viewer role is assigned at the Folder level.
In Google Cloud, resource hierarchy follows Organization > Folder > Project > Resource.
2
Apply the rule of IAM policy inheritance.
Permissions granted on a parent node are inherited by all child resources.
Policy inheritance in Google Cloud IAM is transitive and automatic.

Key Concept

Resource Hierarchy IAM Policy Inheritance
Rate this question

Topics

Managing Cloud Projects and Resource Hierarchy

More questions from this topic