Examkin

Question

Difficulty: MediumManaging Cloud Projects and Resource Hierarchy

An organization is configuring access control across their Google Cloud resource hierarchy for a newly established 'Platform-Engineering' folder. The folder will contain multiple production and staging projects. You need to ensure that a CI/CD service account can deploy and manage infrastructure across all current and future projects in this folder, while developers have read-only access to view all resources in these projects. Following Google Cloud recommended practices and the principle of least privilege, which TWO configuration actions should you perform?

  1. Bind the appropriate predefined administrative roles (such as Compute Admin and Storage Admin) to the CI/CD service account at the 'Platform-Engineering' folder level.Answer
  2. Bind the predefined Viewer role to the developers Google Group at the 'Platform-Engineering' folder level.Answer
  3. C
    Grant the primitive Owner role to the CI/CD service account at the Organization root level to ensure administrative access is never blocked.
  4. D
    Configure explicit Deny policies at individual child project levels to revoke Viewer access granted at the folder level for sensitive sub-resources.
  5. E
    Define an Organization Policy constraint on the 'Platform-Engineering' folder to grant read-only access permissions to the developers group.

Answer

The correct configurations are to grant predefined administrative roles to the service account at the folder level and to grant the Viewer role to the developers group at the folder level.
In Google Cloud resource hierarchy, IAM policies defined at a folder node are inherited by all child projects within that folder. Granting predefined administrative roles to the service account and the Viewer role to the developers group at the folder level ensures consistent, scalable access management aligned with least privilege principles.

Step-by-Step Solution

1
Analyze resource hierarchy requirements for permissions scoping.
Applying policy bindings at the parent folder level ensures automatic downward inheritance to all current and future child projects.
Folder-level IAM administration eliminates the overhead of managing access on individual projects.
2
Select roles adhering to the principle of least privilege for the service account.
Specific predefined roles (such as Compute Admin and Storage Admin) provide necessary deployment capabilities without granting unnecessary organization-wide or owner permissions.
Primitive Owner roles at higher hierarchy levels over-grant administrative power.
3
Select roles adhering to the principle of least privilege for developers.
Binding the predefined Viewer role at the folder level grants read-only access to all resources within child projects.
IAM permissions are additive and inherited down the node hierarchy tree.

Key Concept

IAM Policy Inheritance and Predefined Roles in Google Cloud Resource Hierarchy
Rate this question

Topics

Managing Cloud Projects and Resource Hierarchy

More questions from this topic