Examkin

Question

Difficulty: Very hardManaging IAM Roles and Permissions

An enterprise architecture team is setting up access control for a newly deployed microservice in Google Cloud Project `prod-analytics-v2`. A third-party security auditing team needs to review IAM policy bindings and configuration settings for Cloud Pub/Sub topics and Cloud Storage buckets without viewing payload data or modifying resources. Additionally, an external deployment service account needs to deploy new revisions to Cloud Run services within the project without receiving permissions to modify project IAM policies or create new Cloud Storage buckets. Which of the following IAM role assignments adhere to the principle of least privilege to satisfy these security requirements? (Select TWO.)

  1. Grant the Security Reviewer role (`roles/iam.securityReviewer`) at the project level to the security auditing team.Answer
  2. Grant the Cloud Run Developer role (`roles/run.developer`) at the project level to the external deployment service account.Answer
  3. C
    Grant the Editor primitive role (`roles/editor`) at the project level to the deployment service account to ensure deployment actions succeed.
  4. D
    Grant the Security Reviewer role (`roles/iam.securityReviewer`) at the parent Folder level containing `prod-analytics-v2`.

Answer

Granting the Security Reviewer role at the project level to the auditing team and granting the Cloud Run Developer role at the project level to the deployment service account.
To satisfy least-privilege security requirements, predefined roles should be used instead of primitive roles, and permissions should be scoped precisely to the targeted project rather than parent folders or organization nodes. The Security Reviewer role allows reading security policies and configuration metadata without exposing application payload data. The Cloud Run Developer role allows creating and updating Cloud Run revisions without granting broad project administration permissions.

Step-by-Step Solution

1
Analyze the security auditing team's permission scope
Auditors need to view IAM policies and configuration metadata across project resources without viewing data payloads or modifying settings.
The predefined role `roles/iam.securityReviewer` scoped to the project satisfies this exact requirement without granting access to object/message data.
2
Analyze the deployment service account's permission scope
The service account needs to deploy Cloud Run services without gaining administrative rights over project IAM or other services like Cloud Storage.
The predefined role `roles/run.developer` provides service creation/deployment access specifically for Cloud Run.
3
Evaluate scope and role granularity against least privilege constraints
Primitive roles (`roles/editor`) and higher hierarchy scopes (Folder level) over-grant permissions.
Permissions inherited from higher resource hierarchy levels apply across all child projects, and primitive roles grant broad permissions beyond the required scope.

Key Concept

Applying Least Privilege via Predefined Roles and Project Resource Scope
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic