Examkin

Question

Difficulty: HardIdentity and Access Management (IAM) Roles and Resource Hierarchy

A financial enterprise utilizes a Google Cloud resource hierarchy consisting of an Organization node, a 'Core-Payments' Folder containing multiple production workload projects, and a separate 'SecOps-Central' Project. An automated security auditing tool deployed on a Compute Engine instance in 'SecOps-Central' requires visibility to inspect resource configurations and dataset metadata across all projects in the 'Core-Payments' folder without accessing sensitive underlying records. Additionally, developers assigned to individual projects under 'Core-Payments' must be prevented from attached execution or privilege elevation through this auditing service account. Which IAM role assignment and hierarchy strategy adheres to Google Cloud recommended security practices while minimizing operational complexity?

  1. Grant the predefined roles roles/browser and roles/bigquery.metadataViewer along with roles/storage.bucketViewer to the auditing service account at the 'Core-Payments' folder level, and refrain from granting project developers the roles/iam.serviceAccountUser role on the service account.Answer
  2. B
    Grant the primitive roles/viewer role to the auditing service account at the 'Core-Payments' folder level, and grant developers the roles/iam.serviceAccountUser role on the service account.
  3. C
    Grant specific predefined metadata viewer roles to the auditing service account at the folder level, and grant developers the roles/iam.serviceAccountAdmin role on the service account to manage its configuration.
  4. D
    Grant the roles/storage.admin and roles/bigquery.admin roles to the auditing service account at the project level for each project, relying strictly on IAM policies rather than perimeter controls to prevent data exfiltration.

Answer

Grant the predefined metadata viewer roles at the folder level to leverage resource hierarchy inheritance, while withholding service account user permissions from project developers.
The solution leveraging predefined metadata viewer roles at the folder level complies with the principle of least privilege by granting inspection access to configuration and metadata without exposing underlying data records. Assigning roles at the folder level ensures policy inheritance across all existing and future projects within the folder, avoiding project-by-project maintenance. Denying developers the Service Account User role prevents them from attaching the service account to compute instances or impersonating it to escalate privileges.

Step-by-Step Solution

1
Determine appropriate IAM scope and inheritance point.
Assigning permissions at the folder level ensures all nested projects inherit the policies automatically, minimizing operational overhead.
Resource hierarchy inheritance allows folder policy bindings to apply consistently to child projects.
2
Apply the principle of least privilege for metadata inspection.
Predefined roles such as BigQuery Metadata Viewer and Storage Bucket Viewer grant access to resource structures and settings without exposing sensitive data content.
Primitive Viewer roles or Admin roles expose data records or permit management actions beyond read-only metadata scanning.
3
Protect service account execution boundary.
Withholding Service Account User and Service Account Admin roles from developers prevents privilege escalation and unauthorized impersonation of the security auditor.
Only authorized deployment principals should hold Service Account User permissions.

Key Concept

Resource Hierarchy IAM Inheritance & Least Privilege Role Scoping
Estimated Time:2m 0s
Rate this question

Topics

Identity and Access Management (IAM) Roles and Resource Hierarchy