Examkin

Question

Difficulty: MediumManaging IAM Roles and Resource Access Permissions

An operations engineer requires permissions to restart and reset existing Compute Engine instances in a staging project after automated tests complete. The engineer must not be allowed to create new VM instances, delete persistent disks, or modify Virtual Private Cloud (VPC) network configurations. Which IAM role assignment complies with Google Cloud's principle of least privilege?

  1. Grant the Compute Operator (roles/compute.operator) role to the engineer at the project level.Answer
  2. B
    Grant the Editor (roles/editor) primitive role to the engineer at the project level.
  3. C
    Grant the Compute Admin (roles/compute.admin) role to the engineer at the project level.
  4. D
    Grant the Compute Viewer (roles/compute.viewer) role at the organization level so instance operations inherit down to the project.

Answer

Granting the Compute Operator (roles/compute.operator) role at the project level provides the precise permissions needed to reboot and reset VM instances while withholding instance creation, deletion, and networking administrative privileges.
The Compute Operator (roles/compute.operator) role grants permission to manage the state of Compute Engine instances (such as starting, stopping, and resetting them) without allowing users to create new instances, delete persistent disks, or reconfigure networking resources. This aligns directly with the principle of least privilege.

Step-by-Step Solution

1
Analyze the operational requirements
The target role must allow state management (start, stop, reset) of Compute Engine VMs but prohibit creation or deletion of infrastructure.
Least privilege requires granting only the minimum set of permissions necessary to perform specified tasks.
2
Evaluate role scope and access control types
Primitive roles (Editor) and full admin roles (Compute Admin) provide unnecessary permissions such as creating VMs, modifying network settings, or deleting disks.
Google Cloud best practices dictate choosing targeted predefined roles over broad primitive or administrative roles.
3
Select the correct predefined IAM role
The Compute Operator role (roles/compute.operator) is designed specifically for VM instance operational management without infrastructure provisioning rights.
This role satisfies all operational constraints while adhering strictly to Google Cloud security recommendations.

Key Concept

Selecting predefined IAM roles to enforce least privilege for Compute Engine lifecycle management
Estimated Time:1m 30s
Rate this question

Topics

Managing IAM Roles and Resource Access Permissions

More questions from this topic