Examkin

Question

Difficulty: HardManaging IAM Roles and Resource Access Permissions

An enterprise DevOps team needs to provision access for an automated deployment service account. The service account must be capable of creating, updating, and managing Google Cloud Pub/Sub topics and subscriptions within a staging project, but must not be granted permissions to modify IAM policies or access unrelated services. To follow Google Cloud security best practices and the principle of least privilege, which IAM configuration approach should you choose?

  1. A
    Grant the primitive Editor role (roles/editor) to the service account at the staging project level.
  2. Grant the predefined Pub/Sub Admin role (roles/pubsub.admin) to the service account at the staging project level.Answer
  3. C
    Grant the Pub/Sub Admin role (roles/pubsub.admin) at the parent folder level, and explicitly revoke Pub/Sub permissions at the staging project level.
  4. D
    Grant the Billing Account User role (roles/billing.user) on the staging project to authorize Pub/Sub resource provisioning.

Answer

Grant the predefined Pub/Sub Admin role (roles/pubsub.admin) to the service account at the staging project level.
Granting the predefined Pub/Sub Admin role (roles/pubsub.admin) directly at the staging project level gives the service account full management permissions for Pub/Sub topics and subscriptions while preventing access to unrelated GCP services or project IAM settings, perfectly fulfilling the principle of least privilege.

Step-by-Step Solution

1
Analyze the operational requirements
The service account needs administrative access restricted specifically to Cloud Pub/Sub resources in a single staging project.
Identifying the target service and scope is essential for selecting the minimal set of required permissions.
2
Evaluate role types against Google Cloud security best practices
Predefined roles (such as roles/pubsub.admin) isolate permissions to the relevant service, whereas Primitive roles (Owner, Editor, Viewer) grant excessively broad project-wide access.
Google Cloud mandates using predefined or custom roles instead of primitive roles to adhere to the principle of least privilege.
3
Evaluate resource hierarchy placement
Granting the role directly on the target staging project scope grants access to that project only without exposing other projects in the parent folder.
IAM permissions inherit downward and cannot be revoked at lower levels in the GCP resource hierarchy.

Key Concept

Managing IAM Roles and Resource Access Permissions
Estimated Time:2m 0s
Rate this question

Topics

Managing IAM Roles and Resource Access Permissions

More questions from this topic