Examkin

Question

Difficulty: EasyManaging IAM Roles and Resource Access Permissions

A cloud administrator needs to grant a developer permissions to view Compute Engine virtual machine details and inspect Cloud Logging entries in a Google Cloud project. Following Google Cloud best practices and the principle of least privilege, which of the following predefined roles should be assigned to the developer? (Select TWO.)

  1. Compute Viewer (roles/compute.viewer)Answer
  2. Logs Viewer (roles/logging.viewer)Answer
  3. C
    Editor (roles/editor)
  4. D
    Owner (roles/owner)

Answer

Assign the Compute Viewer (roles/compute.viewer) and Logs Viewer (roles/logging.viewer) predefined roles.
Google Cloud IAM best practices dictate assigning granular predefined roles instead of broad primitive roles. The Compute Viewer role grants read-only access to inspect VM instance details, and the Logs Viewer role grants read-only access to view logs in Cloud Logging. Assigning both fulfills the requirements under the principle of least privilege.

Step-by-Step Solution

1
Analyze the access requirements described in the scenario
The developer only requires read access to Compute Engine VM details and Cloud Logging logs.
Identifying the minimum required permissions prevents granting excessive privilege.
2
Evaluate role types against Google Cloud IAM best practices
Predefined roles tailored to specific service duties must be chosen over broad primitive roles (Owner, Editor, Viewer).
Primitive roles grant project-wide privileges that exceed the scope of the developer's specific needs.
3
Select the correct predefined roles
Compute Viewer provides read-only VM inspection, while Logs Viewer provides read-only access to log records.
Combining these two predefined roles meets the developer's exact functional needs while maintaining security.

Key Concept

Applying Least Privilege using GCP Predefined IAM Roles
Rate this question

Topics

Managing IAM Roles and Resource Access Permissions

More questions from this topic