Examkin

Question

Difficulty: MediumManaging IAM Roles and Resource Access Permissions

A cloud administrator needs to configure access for two team members working in a Google Cloud project. An compliance auditor requires read-only access to view IAM policy bindings across all resources in the project. Additionally, a security engineer needs to create and manage custom IAM roles within the project. Following Google's recommended practices for least privilege, which TWO IAM roles should the administrator grant? (Select TWO.)

  1. Grant the Security Reviewer role (roles/iam.securityReviewer) to the compliance auditor.Answer
  2. Grant the Role Administrator role (roles/iam.roleAdmin) to the security engineer.Answer
  3. C
    Grant the Editor primitive role (roles/editor) to both users at the project level to ensure full administrative visibility.
  4. D
    Revoke IAM permissions at the parent folder level to prevent inherited permissions from overriding project-level IAM roles.

Answer

The administrator should grant the Security Reviewer role (roles/iam.securityReviewer) to the compliance auditor and the Role Administrator role (roles/iam.roleAdmin) to the security engineer.
The Security Reviewer role provides read access to security and IAM configurations without permission to modify resources, fulfilling the auditor's requirement under least privilege. The Role Administrator role allows creating, editing, and deleting custom roles, satisfying the security engineer's duty without granting excess access to project workloads or data.

Step-by-Step Solution

1
Identify the minimum required permissions for the compliance auditor.
The auditor requires read-only visibility into security configurations and IAM policy bindings, which maps directly to the predefined role Security Reviewer (roles/iam.securityReviewer).
Predefined roles are preferred over primitive roles to restrict access to only necessary actions.
2
Identify the minimum required permissions for the security engineer.
The security engineer requires permission to manage custom IAM roles, which corresponds to the Role Administrator role (roles/iam.roleAdmin).
This role grants permission to manage custom roles without granting broad project control or billing access.
3
Evaluate the incorrect options based on IAM principles.
Primitive roles grant excessive privileges, and IAM permissions cannot be revoked at lower levels to block higher-level inherited access.
IAM inheritance is strictly union/additive.

Key Concept

Applying least privilege using predefined IAM roles for security auditing and custom role administration
Rate this question

Topics

Managing IAM Roles and Resource Access Permissions

More questions from this topic