Examkin

Question

Difficulty: MediumManaging IAM Roles and Permissions

A cloud security administrator needs to grant an automated compliance service permission to read metadata and configuration settings for both Cloud SQL instances and Cloud Pub/Sub topics within a target Google Cloud project named `prod-data-pipeline`. The solution must enforce the Principle of Least Privilege and restrict access strictly to the target project. Which two IAM role bindings should you grant to the service account? (Select TWO.)

  1. Grant the Cloud SQL Viewer (roles/cloudsql.viewer) role to the service account on the prod-data-pipeline project.Answer
  2. Grant the Pub/Sub Viewer (roles/pubsub.viewer) role to the service account on the prod-data-pipeline project.Answer
  3. C
    Grant the Editor (roles/editor) primitive role to the service account on the prod-data-pipeline project.
  4. D
    Grant the Cloud SQL Admin (roles/cloudsql.admin) role to the service account at the parent Folder level.

Answer

The correct role bindings are granting Cloud SQL Viewer (roles/cloudsql.viewer) and Pub/Sub Viewer (roles/pubsub.viewer) to the service account scoped specifically to the target project.
To satisfy least privilege for a read-only metadata compliance audit on specific services within a single project, you must assign resource-specific predefined viewer roles—specifically Cloud SQL Viewer (roles/cloudsql.viewer) and Pub/Sub Viewer (roles/pubsub.viewer)—bound directly to the target project. These roles provide exact read visibility into the target services without permitting data modification or inheriting permissions across other projects.

Step-by-Step Solution

1
Identify the required permissions for Cloud SQL and Cloud Pub/Sub
The application requires read-only configuration access for Cloud SQL and Cloud Pub/Sub resources.
Least privilege mandates selecting predefined roles that match exact operational capabilities rather than administrative or broad primitive permissions.
2
Select the appropriate predefined roles matching the required permissions
Select roles/cloudsql.viewer for Cloud SQL access and roles/pubsub.viewer for Cloud Pub/Sub topic/subscription metadata inspection.
These predefined roles isolate read capabilities to their respective services without granting write or administrative privileges.
3
Determine the correct resource hierarchy binding scope
Apply both role bindings directly on the target project (prod-data-pipeline).
Granting roles at higher resource levels (such as parent Folders or the Organization) causes permissions to be inherited across all sibling projects, violating scope restrictions.

Key Concept

Principle of Least Privilege with Predefined Roles and Resource Hierarchy Scope
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic