Examkin

Question

Difficulty: HardEnabling and Managing Cloud Service APIs

A telemetry engineering team is setting up a dedicated workload project named `data-analytics-prod`. The developers need to enable the Cloud Monitoring API (`monitoring.googleapis.com`) and Cloud Logging API (`logging.googleapis.com`) for their services. Additionally, load testing is expected to exceed the default API rate limits during peak operations, requiring quota management. Security policy strictly mandates applying the principle of least privilege without granting broad resource ownership or billing management rights. Which TWO configuration steps should the team take to meet these access control and quota requirements following Google Cloud best practices? (Select TWO answers.)

  1. Grant the developer team the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin) on the data-analytics-prod project.Answer
  2. B
    Enable the required Cloud APIs inside the central shared infrastructure host project so that child workload projects automatically inherit enabled status.
  3. Submit a quota increase request for the affected API metrics through the IAM & Admin Quotas interface within the data-analytics-prod project.Answer
  4. D
    Grant the developer team the Owner role (roles/owner) at the Organization level to allow developers to bypass default API rate limits without quota requests.

Answer

The team should grant the Service Usage Admin role on the target project to allow API enablement under least privilege, and submit a quota increase request via the IAM & Admin Quotas interface within the project when default limits are insufficient.
To satisfy least privilege while allowing API enablement, the Service Usage Admin role should be assigned on the target project because it grants permissions to view and enable APIs without granting full control over project assets. In addition, when traffic demands exceed standard API thresholds, a formal quota increase request must be submitted within the target project's Quotas section.

Step-by-Step Solution

1
Identify the minimum required IAM role for API enablement
Determined that Service Usage Admin (roles/serviceusage.serviceUsageAdmin) grants serviceusage.services.enable permissions on the project.
Primitive roles like Owner or Editor grant excessive broad permissions across all project resources.
2
Determine the proper location for API enablement and quota requests
APIs and quotas are scoped at the specific project level (data-analytics-prod).
Enabling APIs in parent or host projects does not enable them for workload projects, nor does it raise workload project quotas.
3
Formulate the correct workflow for capacity bottlenecks
Submit a formal quota increase request in the Cloud Console under IAM & Admin > Quotas for the target project.
API quotas are enforced by Google Cloud and cannot be bypassed merely by increasing administrative IAM privileges.

Key Concept

API enablement using Service Usage Admin and project-level quota increase request workflows
Estimated Time:2m 0s
Rate this question

Topics

Enabling and Managing Cloud Service APIs

More questions from this topic