Examkin

Question

Difficulty: MediumManaging IAM Roles and Resource Access Permissions

An internal compliance auditor requires read-only access to inspect IAM policy bindings and view the list of enabled Cloud APIs within a Google Cloud project. The auditor must not be permitted to modify permissions, enable or disable APIs, or view underlying data stored in project resources. Which TWO predefined IAM roles should you grant to the auditor to adhere to the principle of least privilege?

  1. Security Reviewer (roles/iam.securityReviewer)Answer
  2. B
    Project Editor (roles/editor)
  3. Service Usage Viewer (roles/serviceusage.serviceUsageViewer)Answer
  4. D
    Project IAM Admin (roles/resourcemanager.projectIamAdmin)

Answer

To meet the compliance auditing requirements with minimal privilege, grant Security Reviewer (roles/iam.securityReviewer) to allow inspecting IAM policies and Service Usage Viewer (roles/serviceusage.serviceUsageViewer) to allow listing enabled Cloud APIs.
Security Reviewer grants read-only access to inspect security settings and IAM policies, while Service Usage Viewer provides read-only access to inspect enabled services and APIs. Combining these two predefined roles satisfies the auditor's read-only requirements without granting unnecessary administrative or write permissions.

Step-by-Step Solution

1
Identify the required access permissions for the auditor role.
The user needs to inspect project IAM policies and list enabled APIs in read-only mode.
Understanding the precise minimal scope prevents over-granting administrative rights.
2
Evaluate predefined roles against the principle of least privilege.
Security Reviewer (roles/iam.securityReviewer) allows viewing security settings and IAM policies. Service Usage Viewer (roles/serviceusage.serviceUsageViewer) allows listing project APIs and service states.
Predefined roles should always be selected over primitive roles or administrative roles when specific read-only capabilities are requested.
3
Eliminate overly permissive options.
Project Editor and Project IAM Admin both allow state modification and privilege administration.
Administrative and primitive roles violate GCP security best practices.

Key Concept

Granting Least-Privilege Predefined Roles for Security Auditing and API Inspection
Rate this question

Topics

Managing IAM Roles and Resource Access Permissions

More questions from this topic