Examkin

Question

Difficulty: HardManaging Cloud Projects and Resource Hierarchy

A security audit reveals that the Google Group `[email protected]` has been granted the `roles/compute.admin` role at a parent Folder level named `Finance-Prod`. This folder contains ten production projects, including a sensitive audit project named `payments-main`. Company security policy requires members of `[email protected]` to retain Compute Engine administrative access across nine of the projects, but they must explicitly have no administrative access to `payments-main`. How should you restructure the IAM configuration to meet this requirement following the principle of least privilege?

  1. Remove the `roles/compute.admin` role binding for `[email protected]` from the `Finance-Prod` folder, and grant the `roles/compute.admin` role directly on each of the nine projects that require it.Answer
  2. B
    Navigate to the `payments-main` project IAM policy settings and remove the `roles/compute.admin` role assignment for `[email protected]`.
  3. C
    Grant the `roles/viewer` primitive role to `[email protected]` on the `payments-main` project to override the folder-level administrative privileges.
  4. D
    Unlink the `payments-main` project from the shared Billing Account and re-link it using a restricted billing account user role.

Answer

Remove the `roles/compute.admin` role binding for `[email protected]` from the `Finance-Prod` folder, and grant `roles/compute.admin` individually on the nine projects requiring access.
In Google Cloud, IAM policy evaluation is additive down the resource hierarchy (Organization > Folder > Project > Resource). If a role is granted at the Folder level, all projects under that folder inherit those permissions. Because inherited permissions cannot be revoked or overridden at a child project level, the folder-level role grant must be removed and replaced with explicit project-level grants on only the projects that require access.

Step-by-Step Solution

1
Analyze IAM resource hierarchy inheritance rules.
Recognize that permissions granted at a parent node (Folder) are inherited down to all child nodes (Projects) and cannot be denied or revoked at the child level.
Google Cloud IAM policies are additive down the resource hierarchy tree.
2
Identify the source of over-privileged access.
The folder-level binding on `Finance-Prod` grants `roles/compute.admin` to all child projects, including `payments-main`.
To restrict access on one child project, the folder-level role binding must be removed.
3
Re-assign permissions following least privilege.
Remove the role grant from the parent folder and apply the `roles/compute.admin` role explicitly on the nine target projects.
This guarantees that `payments-main` does not inherit administrative permissions while preserving required access elsewhere.

Key Concept

Resource Hierarchy IAM Policy Additive Inheritance
Rate this question

Topics

Managing Cloud Projects and Resource Hierarchy

More questions from this topic