Examkin

Question

Difficulty: HardManaging IAM Roles and Permissions

An enterprise security policy requires granting an external analytics team read access to messages processed by a Google Cloud Pub/Sub subscription and read-only access to log archive files in a specific Cloud Storage bucket within the `iot-telemetry-prod` project. The team must not be permitted to publish messages, alter Pub/Sub configurations, or modify/delete storage buckets and objects. Which TWO of the following IAM role configurations follow the principle of least privilege while providing the required access? (Select TWO.)

  1. Grant `roles/pubsub.subscriber` on the specific Pub/Sub subscription in the `iot-telemetry-prod` project.Answer
  2. B
    Grant the primitive `roles/editor` role at the `iot-telemetry-prod` project level.
  3. Grant `roles/storage.objectViewer` directly on the target Cloud Storage bucket resource.Answer
  4. D
    Grant `roles/storage.admin` at the parent Folder level containing the `iot-telemetry-prod` project.

Answer

Granting `roles/pubsub.subscriber` on the Pub/Sub subscription and granting `roles/storage.objectViewer` on the specific Cloud Storage bucket.
The Pub/Sub Subscriber role (`roles/pubsub.subscriber`) provides the minimal permissions necessary to read messages from Pub/Sub subscriptions without granting permissions to modify topics or publish data. Similarly, granting Storage Object Viewer (`roles/storage.objectViewer`) directly on the specific Cloud Storage bucket allows reading object data while preventing object deletion, bucket deletion, or broader project-level changes.

Step-by-Step Solution

1
Analyze required Pub/Sub permissions against the principle of least privilege.
The team only needs to consume subscription messages. The predefined role `roles/pubsub.subscriber` grants subscription consumption rights without allowing topic publishing or management.
Choosing fine-grained predefined roles over primitive roles prevents over-privileging identities.
2
Analyze required Cloud Storage permissions and target scope.
The predefined role `roles/storage.objectViewer` scoped directly to the target bucket permits listing and reading objects without granting deletion or bucket modification rights.
Applying bindings at the resource level avoids granting unintended access across all buckets in the project or folder.
3
Evaluate and eliminate incorrect distractor options.
Assigning primitive Editor access grants broad write permissions project-wide, while folder-level Storage Admin access propagates full administrative rights to all child projects via resource hierarchy inheritance.
Both distractor options violate the principle of least privilege through over-scopings and role severity.

Key Concept

Applying Predefined IAM Roles at Resource-Specific Scopes for Least Privilege
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic