Examkin

Question

Difficulty: EasyManaging IAM Roles and Resource Access Permissions

A system administrator needs permissions to fully manage Cloud SQL database instances and view Pub/Sub topics within a single Google Cloud project. Following Google Cloud security best practices for least privilege without using primitive roles, which TWO predefined IAM roles should be assigned to the administrator?

  1. Cloud SQL Admin (roles/cloudsql.admin)Answer
  2. Pub/Sub Viewer (roles/pubsub.viewer)Answer
  3. C
    Editor (roles/editor)
  4. D
    Pub/Sub Admin (roles/pubsub.admin)

Answer

The correct predefined roles are Cloud SQL Admin (roles/cloudsql.admin) to manage Cloud SQL instances and Pub/Sub Viewer (roles/pubsub.viewer) to view Pub/Sub topics.
Cloud SQL Admin allows full management of Cloud SQL instances, while Pub/Sub Viewer allows viewing Pub/Sub topics and subscriptions without granting modification rights. Together, these predefined roles fulfill the requirements under the principle of least privilege.

Step-by-Step Solution

1
Identify the required permissions for managing Cloud SQL instances.
The Cloud SQL Admin role provides full management permissions for Cloud SQL without granting permissions to unrelated services.
Predefined roles are preferred over primitive roles to enforce the principle of least privilege.
2
Identify the required permissions for viewing Pub/Sub messaging topics.
The Pub/Sub Viewer role grants permission to view topics and subscriptions without administrative or modification privileges.
Read-only access requests should be mapped to Viewer predefined roles rather than Admin roles.

Key Concept

Applying the principle of least privilege using predefined IAM roles instead of primitive or overly permissive roles.
Rate this question

Topics

Managing IAM Roles and Resource Access Permissions

More questions from this topic