Examkin

Question

Difficulty: MediumManaging IAM Roles and Permissions

A software engineering team requires access to deploy and manage Cloud Run revisions, as well as create and view builds using Cloud Build within a specific project named `app-dev-proj`. Company security policy requires adhering strictly to the Principle of Least Privilege by granting fine-grained permissions at the project scope rather than assigning primitive roles or granting permissions higher in the resource hierarchy. Which TWO role bindings should the cloud engineer apply to the engineering team? (Select TWO.)

  1. Assign the Cloud Run Developer role (`roles/run.developer`) at the `app-dev-proj` project level.Answer
  2. B
    Assign the Editor primitive role (`roles/editor`) at the `app-dev-proj` project level.
  3. Assign the Cloud Build Editor role (`roles/cloudbuild.builds.editor`) at the `app-dev-proj` project level.Answer
  4. D
    Assign the Cloud Run Admin role (`roles/run.admin`) at the parent Folder level.

Answer

To follow the Principle of Least Privilege for the specified requirements, the engineer should grant the Cloud Run Developer role (`roles/run.developer`) and the Cloud Build Editor role (`roles/cloudbuild.builds.editor`) scoped directly to the `app-dev-proj` project.
The Cloud Run Developer role (`roles/run.developer`) grants necessary permissions to create and manage Cloud Run revisions and services, while the Cloud Build Editor role (`roles/cloudbuild.builds.editor`) grants permissions to create, view, and manage build requests. Granting both roles at the target project level ensures compliance with the Principle of Least Privilege.

Step-by-Step Solution

1
Identify the required permissions for managing Cloud Run services and executing Cloud Build tasks.
Cloud Run service management requires `roles/run.developer`, and Cloud Build operations require `roles/cloudbuild.builds.editor`.
Predefined roles target specific operational capabilities without over-granting permissions.
2
Determine the appropriate resource scope for the permissions.
Role bindings must be applied at the `app-dev-proj` project scope.
Granting permissions at the folder level causes permissions to be inherited by all child projects within that folder.
3
Select the correct combination of predefined roles at project scope.
The Cloud Run Developer and Cloud Build Editor roles bound at the project level satisfy all conditions.
This combination adheres strictly to the Principle of Least Privilege.

Key Concept

Managing IAM Roles and Permissions
Estimated Time:1m 30s
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic