Examkin

Question

Difficulty: EasyManaging IAM Roles and Resource Access Permissions

A data analyst needs read-only access to view tables and execute queries within existing BigQuery datasets in a Google Cloud project, without the ability to modify table data or create new datasets. Following Google Cloud security best practices for least privilege, which IAM role should you grant to the analyst?

  1. BigQuery Data Viewer (roles/bigquery.dataViewer)Answer
  2. B
    BigQuery Data Editor (roles/bigquery.dataEditor)
  3. C
    Editor (roles/editor)
  4. D
    Owner (roles/owner)

Answer

BigQuery Data Viewer (roles/bigquery.dataViewer)
The BigQuery Data Viewer role (roles/bigquery.dataViewer) grants permissions to view dataset contents, tables, and run queries without permitting users to alter data, create datasets, or manage permissions, strictly satisfying the principle of least privilege.

Step-by-Step Solution

1
Identify the required permissions
The user needs read-only access to view data and execute queries in BigQuery without modification rights.
Security best practices demand assigning the minimum necessary permissions to fulfill the role.
2
Evaluate role options against least privilege principles
BigQuery Data Viewer provides read access to dataset contents, whereas BigQuery Data Editor, Editor, and Owner grant excess write or administrative privileges.
Predefined fine-grained roles should always be preferred over broader predefined or primitive roles.

Key Concept

Principle of Least Privilege using Predefined IAM Roles
Rate this question

Topics

Managing IAM Roles and Resource Access Permissions

More questions from this topic