Examkin

Question

Difficulty: HardManaging IAM Roles and Permissions

An organization needs to grant an external network security auditor read-only access to inspect Virtual Private Cloud (VPC) firewall rules and Compute Engine virtual machine instance configurations within a single Google Cloud project named `prod-network-sec`. The auditor must not be allowed to make structural changes, view sensitive data payloads, or automatically inherit access to other projects under the same organization node. Which of the following IAM role assignments satisfy these requirements while adhering to the principle of least privilege? (Select TWO choices.)

  1. Grant the Compute Viewer (`roles/compute.viewer`) role to the auditor at the `prod-network-sec` project level.Answer
  2. Grant the Security Reviewer (`roles/iam.securityReviewer`) role to the auditor at the `prod-network-sec` project level.Answer
  3. C
    Grant the Editor (`roles/editor`) role to the auditor at the `prod-network-sec` project level.
  4. D
    Grant the Compute Viewer (`roles/compute.viewer`) role to the auditor at the parent Organization resource level.

Answer

The auditor should be granted the Compute Viewer (`roles/compute.viewer`) role and the Security Reviewer (`roles/iam.securityReviewer`) role, both bounded explicitly to the target `prod-network-sec` project level.
To satisfy the auditing requirements under the principle of least privilege, predefined roles specific to the required capabilities must be assigned at the narrowest relevant resource boundary. The Compute Viewer role provides read-only visibility into compute resources within the project, while the Security Reviewer role grants access to view security configurations such as firewall rules and IAM policies. Both bindings must be applied at the project level to prevent unintended inherited access across other projects.

Step-by-Step Solution

1
Identify the required functional access capabilities.
The auditor requires read-only access to VM instance metadata and security firewall configurations.
Choosing fine-grained predefined roles ensures compliance with the principle of least privilege.
2
Map required capabilities to predefined roles instead of broad primitive roles.
Compute Viewer handles VM inspection; Security Reviewer handles security configuration and policy inspection.
Primitive roles like Editor grant unnecessary modification capabilities.
3
Determine the precise scope within the Google Cloud resource hierarchy.
Bind roles at the specific project level (`prod-network-sec`).
Granting roles higher in the resource hierarchy (Organization or Folder level) causes permissions to inherit across unintended projects.

Key Concept

Applying Least Privilege via Scoped Predefined IAM Roles
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic