Examkin

Question

Difficulty: Very hardManaging IAM Roles and Permissions

An enterprise organization manages a Google Cloud resource hierarchy containing a Folder named 'Data-Analytics' with two child projects: 'analytics-prod' and 'analytics-dev'. A compliance audit team requires permissions to run SQL queries and inspect table data strictly in the 'analytics-prod' project. Additionally, the auditors require read-only visibility into Cloud Storage bucket metadata across both projects. Security policy strictly forbids binding IAM roles at the Folder level to prevent unintended inherited access. Which IAM role assignment configuration adheres to the principle of least privilege while complying with the resource hierarchy constraint?

  1. Grant the BigQuery Job User (roles/bigquery.jobUser) and BigQuery Data Viewer (roles/bigquery.dataViewer) roles on 'analytics-prod', and grant the Storage Object Viewer (roles/storage.objectViewer) role on both 'analytics-prod' and 'analytics-dev' individually.Answer
  2. B
    Grant the BigQuery Admin (roles/bigquery.admin) role on 'analytics-prod' and grant the Storage Object Viewer (roles/storage.objectViewer) role at the 'Data-Analytics' folder level.
  3. C
    Grant the Editor (roles/editor) primitive role on 'analytics-prod' and grant the Viewer (roles/viewer) primitive role on 'analytics-dev'.
  4. D
    Grant the BigQuery Job User (roles/bigquery.jobUser) and BigQuery Data Viewer (roles/bigquery.dataViewer) roles on 'analytics-prod', and grant the Viewer (roles/viewer) primitive role on both 'analytics-prod' and 'analytics-dev' individually.

Answer

Grant the BigQuery Job User (roles/bigquery.jobUser) and BigQuery Data Viewer (roles/bigquery.dataViewer) roles on 'analytics-prod', and grant the Storage Object Viewer (roles/storage.objectViewer) role on both 'analytics-prod' and 'analytics-dev' individually.
The correct option applies fine-grained predefined IAM roles (BigQuery Job User, BigQuery Data Viewer, and Storage Object Viewer) at the specific project level scope requested. This fulfills all operational requirements while honoring the restriction against folder-level IAM bindings and avoiding over-privileged primitive roles.

Step-by-Step Solution

1
Analyze resource hierarchy constraints
Identify that role bindings must be made at the project level ('analytics-prod' and 'analytics-dev') rather than the folder level ('Data-Analytics') to prevent permission inheritance.
Organization security rules restrict inherited bindings across folders.
2
Identify BigQuery least-privilege roles for 'analytics-prod'
Select BigQuery Job User (roles/bigquery.jobUser) to allow query execution and BigQuery Data Viewer (roles/bigquery.dataViewer) to view dataset table data.
These predefined roles provide exact capabilities without administrative privileges like BigQuery Admin or broad access like Editor.
3
Identify Cloud Storage least-privilege roles across both projects
Select Storage Object Viewer (roles/storage.objectViewer) applied to 'analytics-prod' and 'analytics-dev' project resources.
This predefined role allows inspecting bucket objects and metadata without granting project-wide read access via the primitive Viewer role.

Key Concept

Applying Predefined IAM Roles at Project Level vs Folder Inheritance and Primitive Roles
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic