Examkin

Question

Difficulty: MediumManaging IAM Roles and Permissions

A security operations team needs to grant a newly hired auditor access to inspect system log entries in Cloud Logging and view Cloud Storage bucket metadata (such as bucket configuration and labels) within a single development project (`proj-dev-42`). The auditor must NOT be able to view object data stored inside the buckets, nor should they receive permissions across other projects in the organization. Adhering to the principle of least privilege, which of the following IAM role assignments should you implement? (Select TWO.)

  1. Grant the Logs Viewer role (roles/logging.viewer) bound to the principal on project proj-dev-42.Answer
  2. B
    Grant the primitive Viewer role (roles/viewer) bound to the principal on project proj-dev-42.
  3. Grant the Storage Bucket Viewer role (roles/storage.bucketViewer) bound to the principal on project proj-dev-42.Answer
  4. D
    Grant the Storage Object Viewer role (roles/storage.objectViewer) bound to the principal at the parent Organization level.

Answer

Grant the Logs Viewer role (roles/logging.viewer) on project proj-dev-42, and grant the Storage Bucket Viewer role (roles/storage.bucketViewer) on project proj-dev-42.
The solution grants narrow predefined roles at the specific project level. The Logs Viewer role allows the user to inspect logs in Cloud Logging, while the Storage Bucket Viewer role provides read-only access to Cloud Storage bucket metadata and configurations without allowing access to object contents.

Step-by-Step Solution

1
Analyze requirement for Cloud Logging access
Assigning roles/logging.viewer scoped strictly to project proj-dev-42 provides necessary permissions to view logs without extra privileges.
Predefined role roles/logging.viewer follows least privilege for log inspection.
2
Analyze requirement for Cloud Storage bucket metadata inspection without object data access
Assigning roles/storage.bucketViewer scoped to project proj-dev-42 grants metadata read access without object content permissions.
Predefined role roles/storage.bucketViewer restricts access to bucket properties only.
3
Verify resource hierarchy scope
Both bindings must be made at the project resource level (proj-dev-42), avoiding organization-level or folder-level inheritance.
Inheritance from parent nodes would grant unintended access across all sibling projects.

Key Concept

Principle of Least Privilege using Predefined IAM Roles and Project-Level Scoping
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic