Examkin

Question

Difficulty: HardManaging IAM Roles and Resource Access Permissions

Your organization requires a junior cloud administrator to manage IAM policy bindings for users on a specific project and inspect predefined and custom role definitions. The administrator must not be granted permissions to modify project resources, create custom roles, or manage project billing. Which TWO predefined IAM roles should you grant to the junior administrator on the project to adhere to the principle of least privilege? (Select TWO answers.)

  1. Project IAM Admin (roles/resourcemanager.projectIamAdmin)Answer
  2. Role Viewer (roles/iam.roleViewer)Answer
  3. C
    Editor (roles/editor)
  4. D
    Owner (roles/owner)

Answer

Grant the Project IAM Admin (roles/resourcemanager.projectIamAdmin) role to manage project-level IAM policy bindings and the Role Viewer (roles/iam.roleViewer) role to inspect predefined and custom role definitions.
To satisfy least privilege requirements, administrative responsibilities must be scoped using specific predefined roles. The Project IAM Admin role allows managing project-level IAM policy bindings, and the Role Viewer role allows inspecting role definitions. Combined, these roles grant the exact permissions required without exposing project resources or billing settings.

Step-by-Step Solution

1
Analyze the access requirements for the junior cloud administrator.
The user needs to manage IAM access control bindings on a project and inspect role definitions, but must not modify compute/storage resources, create custom roles, or manage billing.
Least privilege requires choosing the standard predefined roles that match exact task boundaries.
2
Select the appropriate role for managing policy bindings.
Project IAM Admin (roles/resourcemanager.projectIamAdmin) grants permissions to get and set IAM policies at the project level without granting underlying resource access.
Predefined roles should always be selected over broad primitive roles like Editor or Owner.
3
Select the appropriate role for viewing role definitions.
Role Viewer (roles/iam.roleViewer) grants read-only access to custom and predefined role metadata across IAM.
This fulfills the inspection requirement without allowing custom role creation or modification.

Key Concept

Selecting granular predefined IAM roles for managing project access policies and inspecting role definitions based on the principle of least privilege.
Rate this question

Topics

Managing IAM Roles and Resource Access Permissions

More questions from this topic