Examkin

Question

Difficulty: MediumManaging Cloud Projects and Resource Hierarchy

An enterprise organization is establishing its Google Cloud resource hierarchy for a software engineering division. An Associate Cloud Engineer must grant team leads the capability to create new projects within a specific folder named Mobile-Development and link those newly created projects to the corporate Billing Account. Adhering to the principle of least privilege, which TWO IAM role assignments are required to fulfill these requirements?

  1. Grant the team leads the Project Creator role (roles/resourcemanager.projectCreator) on the Mobile-Development folder.Answer
  2. Grant the team leads the Billing Account User role (roles/billing.user) on the corporate Billing Account.Answer
  3. C
    Grant the team leads the Owner role (roles/owner) on the Organization resource node.
  4. D
    Grant the team leads the Project Creator role (roles/resourcemanager.projectCreator) on each existing project within the folder.
  5. E
    Configure an Organization Policy constraint on the Mobile-Development folder to enable project creation.

Answer

Granting the Project Creator role on the Mobile-Development folder container and granting the Billing Account User role on the Billing Account resource.
To create new projects inside a targeted folder, principals require the Project Creator predefined role (roles/resourcemanager.projectCreator) bound at that folder node. Furthermore, linking any newly created project to a central billing account requires the Billing Account User role (roles/billing.user) on the billing account resource itself.

Step-by-Step Solution

1
Identify the required parent resource container permission for project creation.
The Project Creator role (roles/resourcemanager.projectCreator) must be granted on the Mobile-Development folder.
Creating a project requires permissions on the parent node in the GCP resource hierarchy where the project will reside.
2
Identify the necessary billing permission to associate new projects with billing.
The Billing Account User role (roles/billing.user) must be assigned on the central billing account.
Linking a project to a billing account requires explicit authorization on the billing account object itself.

Key Concept

Resource Hierarchy Project Creation and Billing Account Linking Permissions
Rate this question

Topics

Managing Cloud Projects and Resource Hierarchy

More questions from this topic