Examkin

Question

Difficulty: MediumManaging Cloud Projects and Resource Hierarchy

An enterprise organization uses a Google Cloud resource hierarchy consisting of an Organization node, department Folders, and environment Projects. A compliance auditor needs read-only access to all current and future Google Cloud resources grouped under the 'Finance-Dept' folder. You need to configure access control following Google Cloud best practices and the principle of least privilege. Which action should you take?

  1. Grant the predefined Viewer role (roles/viewer) to the auditor at the 'Finance-Dept' folder level.Answer
  2. B
    Grant the predefined Viewer role (roles/viewer) to the auditor individually on each project currently residing inside the 'Finance-Dept' folder.
  3. C
    Grant the primitive Owner role (roles/owner) to the auditor at the 'Finance-Dept' folder level.
  4. D
    Grant the Billing Account Administrator role (roles/billing.admin) to the auditor on the Billing Account linked to the 'Finance-Dept' projects.

Answer

Grant the predefined Viewer role (roles/viewer) to the auditor at the 'Finance-Dept' folder level.
In Google Cloud's resource hierarchy, IAM policy bindings flow downward from Organization to Folders to Projects to Resources. Assigning the predefined Viewer role at the 'Finance-Dept' folder level grants read-only access to all present and future child resources while maintaining administrative efficiency and the principle of least privilege.

Step-by-Step Solution

1
Identify the resource hierarchy node that encapsulates all target resources.
The 'Finance-Dept' folder is identified as the parent container.
IAM permissions assigned at a higher node in the hierarchy inherit automatically to all lower child resources.
2
Select the role matching the exact read-only access requirement.
The predefined Viewer role (roles/viewer) is selected.
Predefined roles strictly align with the principle of least privilege compared to broad primitive roles.
3
Apply the IAM role binding at the folder level.
The auditor inherits read access across all current and future projects in 'Finance-Dept'.
Folder-level binding eliminates manual configuration for future child projects.

Key Concept

Resource Hierarchy IAM Policy Inheritance
Rate this question

Topics

Managing Cloud Projects and Resource Hierarchy

More questions from this topic