Examkin

Question

Difficulty: EasyManaging IAM Roles and Permissions

Your team needs to grant a newly hired developer access to manage Compute Engine virtual machine instances (create, start, stop, and delete) within a specific Google Cloud project. The developer must not be granted permissions to modify project firewall rules, VPC networks, or IAM policies. Following the principle of least privilege, which IAM role should you grant to the developer at the project level?

  1. Compute Instance Admin (v1) (roles/compute.instanceAdmin.v1)Answer
  2. B
    Editor (roles/editor)
  3. C
    Compute Instance Admin (v1) (roles/compute.instanceAdmin.v1) bound at the Organization level
  4. D
    Owner (roles/owner)

Answer

Grant the predefined Compute Instance Admin (v1) role (roles/compute.instanceAdmin.v1) at the project level.
The Compute Instance Admin (v1) role (roles/compute.instanceAdmin.v1) grants full control over Compute Engine instances while omitting permissions for networking, security, and other GCP services, satisfying the principle of least privilege.

Step-by-Step Solution

1
Identify the required operational capabilities.
The user needs to manage Compute Engine instances (create, start, stop, delete).
Determining exact job requirements allows matching with the most granular IAM role available.
2
Select a role aligned with the principle of least privilege.
The Compute Instance Admin (v1) role provides full instance management without granting network administration or broad project permissions.
Predefined service roles target specific resource management needs, whereas primitive roles (Editor, Owner) grant overly broad permissions.
3
Identify the correct resource hierarchy scope.
Apply the role binding at the specific project level.
Permissions bound at higher levels (Folder or Organization) inherit downward to all child projects.

Key Concept

Least Privilege and IAM Predefined Roles
Estimated Time:1m 0s
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic