Examkin

Question

Difficulty: MediumManaging IAM Roles and Permissions

A cloud operations team needs to grant a newly assigned infrastructure technician permissions to create, stop, and restart Compute Engine virtual machine instances within project `proj-finance-workloads-992`, as well as view system logs in Cloud Logging. Following Google Cloud security best practices and adhering strictly to the principle of least privilege, which TWO IAM predefined roles should be assigned to the technician at the project level? (Select TWO.)

  1. Compute Instance Admin (v1) (roles/compute.instanceAdmin.v1)Answer
  2. Logs Viewer (roles/logging.viewer)Answer
  3. C
    Editor (roles/editor)
  4. D
    Compute Admin (roles/compute.admin) bound at the Organization level

Answer

Assign the Compute Instance Admin (v1) role and the Logs Viewer role at the project scope.
Combining the Compute Instance Admin (v1) role and the Logs Viewer role at the project level provides the technician with exact permissions needed to manage Compute Engine VM lifecycle operations and inspect log entries while adhering to least privilege.

Step-by-Step Solution

1
Identify the specific task permissions required for Compute Engine operations.
Creating, stopping, and restarting Compute Engine virtual machines requires instance-level administrative capabilities supplied by the predefined Compute Instance Admin (v1) role.
Choosing a predefined role targeted to instance operations upholds least privilege without exposing network or security configuration settings.
2
Identify the required logging observation permissions.
Inspecting system logs in Cloud Logging requires log read access, which is supplied by the Logs Viewer role.
Granting Logs Viewer ensures the user can view log entries without granting permission to modify log sinks, metrics, or bucket configurations.
3
Verify resource hierarchy scope.
The role bindings must be applied specifically at the project level (`proj-finance-workloads-992`).
Applying bindings at project scope limits the technician's permissions strictly to the target project environment.

Key Concept

Principle of Least Privilege and Resource Hierarchy Scoping in GCP IAM
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic