Examkin

Question

Difficulty: MediumManaging IAM Roles and Permissions

A cloud operations team needs to grant a network engineer permission to manage VPC subnets and firewall rules in a Google Cloud project named net-prod-2026. The engineer must not be able to create, delete, or modify Compute Engine virtual machine instances or access project storage resources. Following Google Cloud best practices and the principle of least privilege, which IAM role configuration should be granted to the network engineer?

  1. Grant the Compute Network Admin role (roles/compute.networkAdmin) at the project level.Answer
  2. B
    Grant the Editor primitive role (roles/editor) at the project level.
  3. C
    Grant the Compute Admin role (roles/compute.admin) at the project level.
  4. D
    Grant the Compute Network Admin role (roles/compute.networkAdmin) at the Organization level.

Answer

Grant the Compute Network Admin role (roles/compute.networkAdmin) at the project level.
Granting the Compute Network Admin role (roles/compute.networkAdmin) scoped to the specific project provides full control over VPC networking resources, subnets, and firewall rules without granting access to manage VM instances or other non-networking services, exactly fulfilling the principle of least privilege.

Step-by-Step Solution

1
Identify required operational permissions
The engineer requires permissions to manage VPC networks, subnets, and firewall rules.
Networking management is the target responsibility requested by the operations team.
2
Select the narrowest predefined role that covers networking tasks
roles/compute.networkAdmin provides network administration without VM instance lifecycle management permissions.
Predefined roles should be chosen over broad primitive roles (Editor/Owner) or over-privileged predefined roles (Compute Admin) to satisfy the principle of least privilege.
3
Determine the minimum necessary resource hierarchy scope
Bind the role at the project level (net-prod-2026).
Role bindings inherit downward. Binding at the organization level would grant network admin rights across all projects in the organization.

Key Concept

Principle of Least Privilege in GCP IAM Role Assignment
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic