Examkin

Question

Difficulty: HardEnabling and Managing Cloud Service APIs

Your team is deploying a serverless data processing application in a Google Cloud project named proj-data-pipeline. The application requires access to the BigQuery API (bigquery.googleapis.com), but execution fails because the API has not been enabled for the project. Following Google Cloud best practices and the principle of least privilege, which IAM role should you assign to the cloud administrator, and which command must they execute using the Google Cloud CLI to enable the API?

  1. Grant the administrator the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin) on proj-data-pipeline, and execute gcloud services enable bigquery.googleapis.com --project=proj-data-pipeline.Answer
  2. B
    Grant the administrator the Owner role (roles/owner) on proj-data-pipeline, and execute gcloud components enable bigquery.googleapis.com --project=proj-data-pipeline.
  3. C
    Grant the administrator the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin) at the Organization level, and execute gcloud services enable bigquery.googleapis.com without specifying a project flag.
  4. D
    Grant the administrator the Quota Administrator role (roles/servicemanagement.quotaAdmin) on proj-data-pipeline, and execute gcloud alpha quotas requests create --service=bigquery.googleapis.com.

Answer

Grant the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin) to the administrator for proj-data-pipeline, and run gcloud services enable bigquery.googleapis.com --project=proj-data-pipeline.
Enabling a Google Cloud API requires the serviceusage.services.enable permission, which is provided by the predefined Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Executing gcloud services enable bigquery.googleapis.com --project=proj-data-pipeline explicitly enables the service on the designated project while maintaining least privilege.

Step-by-Step Solution

1
Identify the required predefined IAM role for API enablement following least privilege principles.
The predefined role roles/serviceusage.serviceUsageAdmin grants permissions to enable, disable, and inspect APIs without granting full primitive administrative access.
Using predefined roles avoids over-granting permissions such as roles/owner or roles/editor.
2
Determine the correct command structure using the Google Cloud CLI.
The standard command to enable a service API is gcloud services enable <SERVICE_NAME>.
Service enablement is managed under the gcloud services command group.
3
Ensure the target project context is explicitly specified.
Adding --project=proj-data-pipeline ensures the operation applies strictly to the target project.
APIs are enabled per-project, so the correct project context must be specified if not set in default gcloud configuration.

Key Concept

Enabling Cloud Service APIs using gcloud CLI and least privilege IAM roles
Estimated Time:2m 0s
Rate this question

Topics

Enabling and Managing Cloud Service APIs

More questions from this topic