Examkin

Question

Difficulty: HardManaging IAM Roles and Resource Access Permissions

Your organization maintains a Google Cloud environment where projects are grouped under a dedicated folder named Production. A third-party security analyst must review IAM policy bindings, resource configurations, and custom roles across all projects within the Production folder. The analyst must NOT be allowed to view underlying resource data (such as reading Cloud Storage object contents or database records) nor make any configuration changes. Which IAM role assignment fulfills this requirement while adhering strictly to the principle of least privilege?

  1. Grant the Security Reviewer role (roles/iam.securityReviewer) on the Production folder.Answer
  2. B
    Grant the Viewer primitive role (roles/viewer) on the Production folder.
  3. C
    Grant the Security Reviewer role (roles/iam.securityReviewer) on each project individually and apply an explicit deny binding on the Production folder to prevent permission inheritance.
  4. D
    Grant the Billing Account Viewer role (roles/billing.viewer) on the billing account linked to the projects.

Answer

Granting the Security Reviewer role (roles/iam.securityReviewer) at the Production folder level grants the analyst read-only access to inspect IAM policies and configurations for all child projects via resource hierarchy inheritance, without exposing underlying application data or granting edit rights.
Assigning the Security Reviewer role (roles/iam.securityReviewer) at the Production folder level provides read-only access to IAM policies, roles, and project configurations across all child projects via resource hierarchy inheritance, while explicitly withholding access to view sensitive underlying data.

Step-by-Step Solution

1
Analyze the access requirement
The analyst requires read-only access to IAM policies and project resource metadata across multiple projects in the Production folder, but must not access actual resource data or alter permissions.
Security best practices demand enforcing least privilege tailored to metadata inspection.
2
Evaluate role types (Primitive vs. Predefined)
The primitive Viewer role permits viewing resource data contents, whereas the predefined Security Reviewer role (roles/iam.securityReviewer) restricts access to security configurations and metadata.
Google Cloud recommends using predefined roles over primitive roles to restrict data access.
3
Determine appropriate resource hierarchy placement
Binding the role at the Production folder level allows all current and future projects under that folder to inherit the policy binding automatically.
Folder-level assignment leverages GCP resource hierarchy inheritance cleanly without requiring per-project configuration.

Key Concept

Selecting predefined IAM roles over primitive roles and leveraging folder-level resource hierarchy inheritance for security auditing.
Rate this question

Topics

Managing IAM Roles and Resource Access Permissions

More questions from this topic