Examkin

Question

Difficulty: Very hardManaging IAM Roles and Permissions

A security engineer must configure IAM access for an external automated auditing tool's service account. The tool needs to read all object data stored inside Cloud Storage buckets in a project named `finance-reporting` and send custom metric telemetry to Cloud Monitoring within the same project. To pass compliance, access must strictly enforce the principle of least privilege and be scoped without granting unnecessary administrative permissions or resource hierarchy inheritance overhead. Which TWO role assignments should be granted to the service account on the `finance-reporting` project?

  1. Grant the Storage Object Viewer role (roles/storage.objectViewer) on the finance-reporting project.Answer
  2. Grant the Monitoring Metric Writer role (roles/monitoring.metricWriter) on the finance-reporting project.Answer
  3. C
    Grant the Editor role (roles/editor) on the finance-reporting project.
  4. D
    Grant the Storage Admin role (roles/storage.admin) at the parent Organization level.

Answer

Granting the Storage Object Viewer role (roles/storage.objectViewer) and the Monitoring Metric Writer role (roles/monitoring.metricWriter) bound directly at the target project level fulfills the read and telemetry requirements while strictly enforcing the principle of least privilege.
To satisfy security auditing requirements under the principle of least privilege, specific predefined roles must be selected for each task and scoped directly to the target project. The Storage Object Viewer role provides necessary object read access without bucket management rights, while the Monitoring Metric Writer role provides exact permissions to write telemetry data to Cloud Monitoring without additional observability privileges.

Step-by-Step Solution

1
Analyze storage access requirement
Identified that reading object data in Cloud Storage requires object read permissions without bucket management rights.
The Storage Object Viewer predefined role (roles/storage.objectViewer) grants read access to bucket objects without administrative capabilities.
2
Analyze monitoring access requirement
Identified that writing custom metric telemetry requires specific monitoring write permissions.
The Monitoring Metric Writer predefined role (roles/monitoring.metricWriter) permits publishing metric data to Cloud Monitoring.
3
Evaluate scoping and least privilege boundaries
Bound both predefined roles directly at the target project level (`finance-reporting`).
Binding roles at the project level prevents permission inheritance across other projects and avoids overly broad primitive roles like Editor or Owner.

Key Concept

Applying Least-Privilege Predefined IAM Roles at Project Scope
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic