Examkin

Question

Difficulty: HardManaging IAM Roles and Resource Access Permissions

Your organization has a Google Cloud folder named 'Analytics' containing multiple projects with Cloud Storage buckets storing raw telemetry data. A new data analyst needs to read all objects within these Cloud Storage buckets across all projects under the 'Analytics' folder. Additionally, the analyst must be able to execute BigQuery queries using a specific project named 'query-runner' located within the same folder, without having permissions to modify data, alter bucket configurations, or view IAM policy bindings. Which combination of IAM roles assigned to the data analyst follows Google-recommended best practices of least privilege?

  1. Grant Storage Object Viewer (roles/storage.objectViewer) on the 'Analytics' folder, and grant BigQuery Job User (roles/bigquery.jobUser) on the 'query-runner' project.Answer
  2. B
    Grant Viewer (roles/viewer) on the 'Analytics' folder.
  3. C
    Grant Storage Admin (roles/storage.admin) on the 'Analytics' folder, and grant BigQuery Admin (roles/bigquery.admin) on the 'query-runner' project.
  4. D
    Grant Storage Object Viewer (roles/storage.objectViewer) on the 'query-runner' project, expecting permissions to inherit upward to the 'Analytics' folder and all sibling projects.

Answer

Grant Storage Object Viewer (roles/storage.objectViewer) on the 'Analytics' folder, and grant BigQuery Job User (roles/bigquery.jobUser) on the 'query-runner' project.
Granting Storage Object Viewer on the parent folder allows read access to all storage objects across child projects via resource hierarchy inheritance, while avoiding administrative access. Granting BigQuery Job User specifically on the query-running project enables running queries without granting dataset modification rights. This combination strictly enforces the principle of least privilege using predefined roles.

Step-by-Step Solution

1
Analyze the access requirement for reading Cloud Storage objects across all projects under the folder.
Determine that granting a role at the folder level allows IAM policy inheritance down to all projects and buckets within that folder.
Resource hierarchy inheritance ensures consistent access across all present and future projects in the folder.
2
Select the appropriate role for reading storage objects without admin or edit permissions.
Choose the predefined role Storage Object Viewer (roles/storage.objectViewer).
Predefined roles are preferred over primitive roles (like Viewer) to enforce least privilege.
3
Determine the necessary permission for executing BigQuery jobs in the target project.
Choose BigQuery Job User (roles/bigquery.jobUser) on the 'query-runner' project.
This role allows running query jobs in the project without granting unnecessary data editing or administrative permissions.

Key Concept

Resource hierarchy inheritance and predefined roles for least privilege
Estimated Time:2m 0s
Rate this question

Topics

Managing IAM Roles and Resource Access Permissions

More questions from this topic