Examkin

Question

Difficulty: HardManaging Cloud Projects and Resource Hierarchy

An enterprise organization manages its Google Cloud environment using a resource hierarchy where an 'Applications' folder contains three distinct sub-folders named 'Development', 'Staging', and 'Production'. The central compliance auditing team requires read-only access to inspect Cloud Storage objects across all current and future projects created within the 'Staging' and 'Production' folders. Company security policy strictly forbids this audit team from viewing any data in the 'Development' environment. Which administrative action correctly enforces these access requirements while adhering to the principle of least privilege and minimizing administrative overhead?

  1. Grant the Storage Object Viewer (roles/storage.objectViewer) role to the compliance auditing team separately on the 'Staging' folder and the 'Production' folder.Answer
  2. B
    Grant the Storage Object Viewer (roles/storage.objectViewer) role to the compliance auditing team on the parent 'Applications' folder, and then revoke the inherited role on the 'Development' folder.
  3. C
    Grant the primitive Owner (roles/owner) role to the compliance auditing team on every individual project currently residing inside the 'Staging' and 'Production' folders.
  4. D
    Grant the Billing Account User (roles/billing.user) role to the compliance auditing team on the parent organization node to grant project-level storage viewing access.

Answer

Granting the Storage Object Viewer (roles/storage.objectViewer) role to the compliance auditing team on both the 'Staging' folder and 'Production' folder correctly satisfies the requirement.
In the Google Cloud resource hierarchy, IAM access policies applied at a folder level automatically propagate down to all child projects and resources inside that folder. Granting the Storage Object Viewer role at the 'Staging' and 'Production' folder nodes ensures that current and future projects inherit read access, while completely isolating the 'Development' folder without incurring project-by-project management overhead.

Step-by-Step Solution

1
Analyze resource hierarchy and IAM inheritance requirements
Permissions granted at a folder level automatically inherit down to all child projects and resources within that folder, including future resources.
Hierarchical inheritance eliminates the administrative effort of granting permissions on individual projects.
2
Evaluate inheritance restriction rules across the hierarchy
GCP IAM policies are strictly additive; lower-level nodes cannot revoke access inherited from higher parent nodes.
Granting access at the parent 'Applications' folder would unavoidably inherit down into 'Development', violating policy.
3
Select predefined role meeting least privilege
The Storage Object Viewer (roles/storage.objectViewer) role provides read-only access to object data without granting excessive administrative permissions.
Using predefined roles avoids over-granting permissions compared to broad primitive roles.

Key Concept

Google Cloud Resource Hierarchy and IAM Policy Additive Inheritance
Rate this question

Topics

Managing Cloud Projects and Resource Hierarchy

More questions from this topic