Examkin

Question

Difficulty: EasyManaging IAM Roles and Permissions

An organization needs to grant a newly contracted developer read-only access to inspect Compute Engine virtual machines and view Cloud Storage objects within a specific Google Cloud project named `dev-sandbox-304`. The access must strictly adhere to the principle of least privilege without granting permissions across other projects. Which of the following actions should the cloud administrator take? (Select TWO.)

  1. Grant the Compute Viewer (`roles/compute.viewer`) role to the developer on the `dev-sandbox-304` project.Answer
  2. Grant the Storage Object Viewer (`roles/storage.objectViewer`) role to the developer on the `dev-sandbox-304` project.Answer
  3. C
    Grant the Editor (`roles/editor`) primitive role to the developer on the `dev-sandbox-304` project.
  4. D
    Grant the Compute Viewer (`roles/compute.viewer`) role to the developer at the parent Organization level.

Answer

Granting the Compute Viewer (`roles/compute.viewer`) role and the Storage Object Viewer (`roles/storage.objectViewer`) role directly on the target project `dev-sandbox-304` provides the exact read-only permissions required while adhering to least privilege.
Assigning predefined roles (`roles/compute.viewer` and `roles/storage.objectViewer`) at the specific project level gives the developer precisely the read permissions required for Compute Engine and Cloud Storage without granting excess rights or broad scope across other projects.

Step-by-Step Solution

1
Identify the required permissions for Compute Engine and Cloud Storage.
The developer requires read-only access to Compute Engine instances and Cloud Storage objects.
Least privilege mandates choosing predefined roles tailored to specific service read requirements rather than broad primitive roles.
2
Select the appropriate predefined roles.
`roles/compute.viewer` provides read access to Compute Engine, and `roles/storage.objectViewer` provides read access to Cloud Storage objects.
Predefined roles limit actions to specific resource capabilities.
3
Determine the resource hierarchy scope for the role bindings.
Bind both roles at the project level (`dev-sandbox-304`).
Granting roles at higher levels (Folder or Organization) causes child inheritance across unintended projects.

Key Concept

Applying Least Privilege IAM Role Scope and Predefined Roles
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic