Examkin

Question

Difficulty: Very hardEnabling and Managing Cloud Service APIs

An infrastructure team is deploying an automated compliance scanner inside a target Google Cloud project named `sec-audit-984`. During execution, the scanner fails because calls to the Cloud Asset API (`cloudasset.googleapis.com`) return a `SERVICE_DISABLED` error. The security administrator wants to delegate the necessary permissions to a junior engineer to enable this API on `sec-audit-984`. To strictly follow the principle of least privilege, which action should the security administrator take?

  1. Grant the junior engineer the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin) on project sec-audit-984, and have them execute gcloud services enable cloudasset.googleapis.com --project=sec-audit-984.Answer
  2. B
    Grant the junior engineer the Editor role (roles/editor) on project sec-audit-984, and have them execute gcloud services enable cloudasset.googleapis.com --project=sec-audit-984.
  3. C
    Grant the junior engineer the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin) at the parent Organization node so the API is enabled globally across all projects.
  4. D
    Grant the junior engineer the Billing Account User role on the linked billing account, and have them submit a quota increase request for Cloud Asset API endpoints.

Answer

Grant the junior engineer the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin) on project sec-audit-984, and have them execute gcloud services enable cloudasset.googleapis.com --project=sec-audit-984.
To enable Google Cloud APIs in accordance with the principle of least privilege, administrators should grant the predefined Service Usage Admin role (roles/serviceusage.serviceUsageAdmin) scoped to the specific project. The operator can then use the gcloud CLI command 'gcloud services enable' targeting that project.

Step-by-Step Solution

1
Identify the specific capability required
The requirement is enabling a Google Cloud Service API on a specific project.
When a workload receives a SERVICE_DISABLED error, the corresponding API endpoint must be enabled for that consumer project.
2
Apply the principle of least privilege to select the appropriate IAM role
Select roles/serviceusage.serviceUsageAdmin over primitive roles like Editor or Owner.
Service Usage Admin allows enabling and disabling APIs without granting broader resource modification or IAM management rights.
3
Determine the scope and CLI command for execution
Bind the role at the target project level (sec-audit-984) and run gcloud services enable cloudasset.googleapis.com --project=sec-audit-984.
APIs are enabled on per-project consumer contexts, so the scope of the operation must target the specific project.

Key Concept

Enabling Cloud Service APIs using least-privilege IAM roles and gcloud CLI commands
Estimated Time:2m 0s
Rate this question

Topics

Enabling and Managing Cloud Service APIs

More questions from this topic