Examkin

Question

Difficulty: EasyManaging IAM Roles and Permissions

A junior administrator needs to check the status and configuration details of Compute Engine virtual machine instances within a specific Google Cloud project. The administrator must not be allowed to perform administrative tasks, create new instances, or stop running virtual machines. To comply with the principle of least privilege, which IAM role should you grant to the administrator at the project level?

  1. Compute Viewer (roles/compute.viewer)Answer
  2. B
    Viewer (roles/viewer)
  3. C
    Compute Admin (roles/compute.admin)
  4. D
    Editor (roles/editor)

Answer

Grant the Compute Viewer (roles/compute.viewer) role at the project level.
Granting the Compute Viewer (roles/compute.viewer) role at the project level adheres strictly to the principle of least privilege by providing read-only access to Compute Engine resources while withholding read access to unrelated services and preventing any modification or lifecycle control.

Step-by-Step Solution

1
Identify the specific resource scope and access requirement.
The requirement is read-only access to Compute Engine instances in a single project.
Permissions should be restricted only to the service required.
2
Apply the principle of least privilege by selecting a predefined service role over broad primitive roles.
Compute Viewer (roles/compute.viewer) provides read-only access to Compute Engine resources without granting access to other GCP services or administrative write actions.
Primitive roles like Viewer or Editor grant excessive permissions across the entire project.

Key Concept

Selecting predefined service roles to enforce the principle of least privilege.
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic