Examkin

Question

Difficulty: MediumManaging IAM Roles and Permissions

A security team needs to grant a newly hired compliance auditor access to review IAM policy bindings and inspect Cloud Logging logs within project `analytics-prod-404`. The auditor must NOT be granted access to read actual data stored inside Cloud Storage buckets or BigQuery tables, nor be permitted to modify any security policies. Which of the following IAM role assignments adhere to the principle of least privilege while fulfilling these requirements? (Select TWO.)

  1. Assign the Security Reviewer role (`roles/iam.securityReviewer`) on project `analytics-prod-404`.Answer
  2. Assign the Logs Viewer role (`roles/logging.viewer`) on project `analytics-prod-404`.Answer
  3. C
    Assign the Project Viewer role (`roles/viewer`) on project `analytics-prod-404`.
  4. D
    Assign the Security Reviewer role (`roles/iam.securityReviewer`) at the Organization level.

Answer

The correct role assignments are granting the Security Reviewer role (`roles/iam.securityReviewer`) on project `analytics-prod-404` and granting the Logs Viewer role (`roles/logging.viewer`) on project `analytics-prod-404`.
Combining the predefined roles `roles/iam.securityReviewer` and `roles/logging.viewer` at the project resource level directly satisfies the least-privilege requirement. It provides read access to security configurations and Cloud Logging logs without exposing stored data or extending access beyond project `analytics-prod-404`.

Step-by-Step Solution

1
Identify the required permissions needed for the job role
The compliance auditor needs read-only access to IAM policy configurations and Cloud Logging logs specifically within project `analytics-prod-404`.
Security auditing requires viewing access control policies and operational logs.
2
Select predefined roles that fulfill least privilege without granting data access
`roles/iam.securityReviewer` provides read access to security configuration settings, and `roles/logging.viewer` grants read access to log entries.
Predefined roles limit permission scope compared to primitive roles like Project Viewer which grant broad access to stored data.
3
Determine the appropriate resource hierarchy scope for the binding
Bind both roles directly to project `analytics-prod-404`.
Granting roles at the Organization level would unnecessarily grant access across all projects via resource hierarchy inheritance.

Key Concept

Principle of Least Privilege with Predefined Roles and Resource Hierarchy Scoping
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic