Examkin

Question

Difficulty: HardManaging IAM Roles and Permissions

An organization is onboarding a database maintenance specialist who requires full operational control over Cloud SQL database instances—including modifying instance flags, restarting instances, and creating backups—within a target project named `finance-prod`. To satisfy strict compliance policies, the specialist must not be granted permissions to modify VPC network settings, manage project-level access controls, or access resources in adjacent environment projects. Which IAM role assignment strategy correctly fulfills these operational requirements while adhering to the principle of least privilege?

  1. Grant the Cloud SQL Admin (`roles/cloudsql.admin`) role to the specialist on the `finance-prod` project.Answer
  2. B
    Grant the Editor (`roles/editor`) role to the specialist on the `finance-prod` project.
  3. C
    Grant the Cloud SQL Admin (`roles/cloudsql.admin`) role to the specialist at the parent Folder level containing all environment projects.
  4. D
    Grant the Owner (`roles/owner`) role to the specialist on the `finance-prod` project.

Answer

Granting the predefined Cloud SQL Admin (`roles/cloudsql.admin`) role specifically on the `finance-prod` project.
The Cloud SQL Admin (`roles/cloudsql.admin`) role is a service-specific predefined role that contains all permissions needed to manage Cloud SQL instances, flags, and backups. Binding this role directly on the `finance-prod` project restricts access exclusively to Cloud SQL within that single project, perfectly aligning with the principle of least privilege without exposing VPC networking or IAM access controls.

Step-by-Step Solution

1
Analyze required job responsibilities and scope
The user needs operational management of Cloud SQL database instances specifically within the single project `finance-prod`.
Determining exact resource boundaries prevents granting excess scope across folders or organizations.
2
Evaluate role types against the principle of least privilege
Predefined roles provide service-specific capabilities (Cloud SQL administration) whereas primitive roles (Owner, Editor, Viewer) grant overly broad project-wide rights.
Selecting predefined roles ensures compliance by withholding permissions for VPC networking and IAM policy management.
3
Select the appropriate resource hierarchy scope
Binding `roles/cloudsql.admin` at the project level (`finance-prod`) limits the permissions to that exact project.
Binding at the folder or organization level causes mandatory downward inheritance to all other projects.

Key Concept

Principle of Least Privilege using Predefined IAM Roles and Project-Level Scoping
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic