Examkin

Question

Difficulty: MediumManaging IAM Roles and Resource Access Permissions

An organization's security compliance team needs to audit Google Cloud Pub/Sub resource configurations and inspect subscription metrics across all projects inside a designated Folder. However, compliance policies strictly prohibit the team from viewing or pulling actual Pub/Sub message payloads. Following Google Cloud recommended best practices and the principle of least privilege, which TWO predefined IAM roles should be granted to the security compliance team at the Folder level?

  1. Pub/Sub Viewer (roles/pubsub.viewer)Answer
  2. Monitoring Viewer (roles/monitoring.viewer)Answer
  3. C
    Pub/Sub Subscriber (roles/pubsub.subscriber)
  4. D
    Editor (roles/editor)

Answer

The correct roles to grant are Pub/Sub Viewer (roles/pubsub.viewer) and Monitoring Viewer (roles/monitoring.viewer).
To satisfy the audit requirements under the principle of least privilege, the compliance team requires two distinct capabilities: metadata visibility for Pub/Sub resources and read access to monitoring metrics. The Pub/Sub Viewer role allows inspecting topics, subscriptions, and configurations without granting message pulling permissions. The Monitoring Viewer role provides access to view metrics such as backlog sizes and message throughput in Cloud Monitoring. Inherited at the Folder level, these two predefined roles provide full folder-wide compliance auditing while protecting payload privacy.

Step-by-Step Solution

1
Analyze access requirements and security constraints
The team needs access to resource configurations (metadata) and performance metrics, but must not be allowed to pull or read message contents.
Security compliance requires auditing setup and operational metrics without exposing sensitive message data.
2
Select the least-privilege IAM role for resource configuration visibility
Pub/Sub Viewer (roles/pubsub.viewer) allows viewing topics and subscriptions without message consumption rights.
Other roles such as Pub/Sub Subscriber permit pulling message payloads.
3
Select the least-privilege IAM role for metrics visibility
Monitoring Viewer (roles/monitoring.viewer) provides access to Cloud Monitoring metrics across the folder.
This allows monitoring subscription message counts and rate metrics safely.

Key Concept

Selecting predefined IAM roles for resource metadata and monitoring under the principle of least privilege.
Rate this question

Topics

Managing IAM Roles and Resource Access Permissions

More questions from this topic