Examkin

Question

Difficulty: EasyManaging Compute Engine Resources

Your organization wants to allow a junior administrator to perform basic operational tasks on Compute Engine virtual machines, such as starting, stopping, and resetting instances, without granting full project administration rights. Following Google Cloud best practices for security and access control, which predefined IAM role should you assign to the administrator?

  1. Compute Instance Admin (v1)Answer
  2. B
    Owner
  3. C
    Compute Network Admin
  4. D
    Monitoring Metric Writer

Answer

Assign the Compute Instance Admin (v1) predefined role to grant instance management capabilities without excessive administrative privileges.
The Compute Instance Admin (v1) role provides full control over Compute Engine instances, including permissions to create, start, stop, and restart VMs, while restricting control to instance resources specifically.

Step-by-Step Solution

1
Identify the operational requirement.
The administrator needs permissions to start, stop, and reset Compute Engine virtual machines.
Determines the specific IAM permissions required for daily VM lifecycle operations.
2
Apply Google Cloud IAM best practices.
Select a predefined role rather than a broad primitive role (Owner/Editor) to maintain least privilege.
Predefined roles restrict permissions to a specific service or resource type.
3
Select the appropriate Compute Engine role.
Compute Instance Admin (v1) provides full management rights over Compute Engine instances.
Fulfills all lifecycle management requirements while restricting access to non-compute project resources.

Key Concept

Managing Compute Engine IAM Roles and Access Control
Rate this question

Topics

Managing Compute Engine Resources

More questions from this topic