Examkin

Question

Difficulty: EasyIdentity and Access Management (IAM) Roles and Resource Hierarchy

An enterprise security team needs to grant an external compliance auditor permission to view BigQuery dataset metadata for all Google Cloud projects contained within a specific department folder. The solution must adhere to the principle of least privilege and minimize administrative overhead. Which action should the Cloud Architect take?

  1. Grant the predefined BigQuery Metadata Viewer role (roles/bigquery.metadataViewer) on the department folder node.Answer
  2. B
    Grant the primitive Viewer role (roles/viewer) at the Organization resource node.
  3. C
    Grant the Service Account User role (roles/iam.serviceAccountUser) on each project within the folder.
  4. D
    Configure a VPC Service Controls security perimeter around the department folder to allow metadata access.

Answer

Grant the predefined BigQuery Metadata Viewer role (roles/bigquery.metadataViewer) on the department folder node.
Granting the predefined BigQuery Metadata Viewer role at the folder level leverages resource hierarchy inheritance so that all current and future projects within the folder inherit metadata viewing rights without granting access to table data or other GCP services.

Step-by-Step Solution

1
Identify the required access scope and level of permission.
The auditor requires metadata-only read access for BigQuery datasets scoped exclusively to projects under a specific folder.
The requirement stresses least privilege and administrative efficiency.
2
Evaluate resource hierarchy inheritance in Google Cloud IAM.
Permissions applied at a folder node are inherited by all child projects and resources inside that folder.
Applying the IAM binding at the folder level eliminates the need to configure each project individually.
3
Select the minimal role meeting the functional requirement.
The predefined role `roles/bigquery.metadataViewer` grants metadata inspection without exposing underlying dataset contents or granting primitive viewer rights across unrelated services.
Using predefined fine-grained roles aligns with security best practices.

Key Concept

Resource Hierarchy Permission Inheritance and Predefined IAM Roles
Rate this question

Topics

Identity and Access Management (IAM) Roles and Resource Hierarchy