Examkin

Question

Difficulty: MediumManaging IAM Roles and Permissions

An external security auditor needs read-only access to inspect Compute Engine instance configurations, network interface details, and instance metadata within a specific Google Cloud project named `retail-store-prod`. The auditor must not be permitted to make modifications to any compute resources or access resources outside of this project. Following the principle of least privilege, which IAM role configuration should be granted to the auditor?

  1. Grant the `roles/compute.viewer` predefined role on the `retail-store-prod` project.Answer
  2. B
    Grant the `roles/viewer` primitive role on the `retail-store-prod` project.
  3. C
    Grant the `roles/compute.viewer` predefined role on the parent Folder containing the project.
  4. D
    Grant the `roles/compute.admin` predefined role on the `retail-store-prod` project.

Answer

Grant the `roles/compute.viewer` predefined role bound specifically at the `retail-store-prod` project level.
The correct answer adheres to the principle of least privilege by combining a service-specific predefined role (`roles/compute.viewer`) with the exact scope requested (project level). This ensures the security auditor can inspect Compute Engine instances without gaining access to non-compute services or other projects in the resource hierarchy.

Step-by-Step Solution

1
Identify the required permissions needed by the principal.
The user requires read-only inspection access restricted strictly to Compute Engine resources.
Understanding the required action prevents over-granting administrative permissions.
2
Select the appropriate role type adhering to least privilege.
Choose the predefined `roles/compute.viewer` role instead of the primitive `roles/viewer` or administrative `roles/compute.admin` role.
Predefined roles offer fine-grained permissions tailored to specific service responsibilities.
3
Determine the narrowest required resource hierarchy scope for the role binding.
Bind the role directly at the `retail-store-prod` project level.
Binding at higher levels like Folders or Organizations causes permission inheritance across unneeded projects.

Key Concept

Principle of Least Privilege with Predefined Roles and Resource Hierarchy Scoping
Estimated Time:1m 30s
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic