Examkin

Question

Difficulty: HardManaging and Requesting GCP Resource Quotas

An enterprise operations team is preparing to launch an automated indexing service in project `prod-search-index`. The service requires provisioning 60 TB60\text{ TB} of `pd-ssd` storage in the `asia-east1` region. During deployment, Compute Engine returns a quota error indicating that the `SSD_TOTAL_GB` regional limit has been reached. A cloud engineer needs to assign a junior team member the minimal required permissions to view quota metrics and submit a quota increase request for this region using the Google Cloud Console. Which IAM role should be assigned to the user on the project?

  1. Quota Administrator (roles/servicemanagement.quotaAdmin)Answer
  2. B
    Billing Account Administrator (roles/billing.admin)
  3. C
    Compute Admin (roles/compute.admin)
  4. D
    Project Editor (roles/editor)

Answer

Assigning the Quota Administrator (roles/servicemanagement.quotaAdmin) role grants the user the specific permissions required to view quota limits, monitor resource consumption, and request quota increases in Google Cloud while respecting least-privilege access control.
The Quota Administrator role (roles/servicemanagement.quotaAdmin) delivers the minimum required permissions to inspect current project quotas and submit quota increase requests via the Cloud Quotas API or Google Cloud Console. This fulfills the requirement while adhering strictly to the principle of least privilege.

Step-by-Step Solution

1
Identify the operational requirement and privilege constraints
The requirement is to view current usage metrics and submit a regional quota increase for SSD_TOTAL_GB in asia-east1 using least privilege.
Security best practices dictate providing only the permissions necessary to perform quota operations without granting broader resource modification rights.
2
Evaluate IAM roles related to resource quota management
The Quota Administrator role (roles/servicemanagement.quotaAdmin) provides the servicemanagement.quotaAdmin permission set required to view and request quota adjustments across GCP services.
Predefined roles like Quota Administrator isolate administrative quota tasks from billing or compute instance management.
3
Eliminate roles that violate least privilege or address unrelated services
Compute Admin and Project Editor over-privilege the user by granting full compute/resource management, while Billing Account Administrator targets billing configuration rather than service quota adjustments.
Resource quotas are managed through Service Management / Cloud Quotas and require specific quota administration privileges.

Key Concept

Least-privilege IAM configuration for GCP resource quota management
Estimated Time:2m 0s
Rate this question

Topics

Managing and Requesting GCP Resource Quotas

More questions from this topic