Examkin

Question

Difficulty: HardIdentity and Access Management (IAM) Roles and Resource Hierarchy

A multinational retail company structures its Google Cloud environment with dedicated folders for regional business units underneath the organization node. A third-party compliance agency requires read-only access to review IAM policies, asset metadata, and security settings across all projects in the hierarchy. However, company governance strictly prohibits the agency from viewing underlying application data stored within Cloud Storage objects or database instances. Which IAM configuration fulfills these requirements while maintaining least privilege and minimizing management overhead?

  1. Grant the roles/browser and roles/iam.securityReviewer predefined roles to the auditor group at the Organization node.Answer
  2. B
    Grant the primitive roles/viewer role to the auditor group at the Organization node.
  3. C
    Create a dedicated service account assigned roles/iam.serviceAccountAdmin across all regional folders and allow the auditor group to impersonate it.
  4. D
    Grant the primitive roles/editor role to the auditor group at the Organization node while restricting network ingress using VPC Service Controls.

Answer

Granting the predefined roles for Browser and Security Reviewer to the auditor group at the Organization level satisfies the security requirements with minimal operational overhead.
Assigning the Security Reviewer and Browser roles at the Organization level leverages resource hierarchy policy inheritance so permissions automatically apply across all folders and projects. The Security Reviewer role grants access to view IAM policies and configuration metadata without exposing application data stored in Cloud Storage or database engines.

Step-by-Step Solution

1
Analyze access scope and auditing requirements across the Google Cloud resource hierarchy.
The auditors need access across all current and future regional projects contained within folders under the organization.
Assigning IAM roles at the Organization node enables permissions to inherit down the entire resource tree automatically, eliminating per-folder administrative maintenance.
2
Evaluate candidate IAM roles against least privilege security constraints.
The Security Reviewer role (roles/iam.securityReviewer) permits inspecting IAM policies and configurations without granting data read permissions, while the Browser role (roles/browser) allows viewing the hierarchy layout.
Predefined security roles separate metadata and policy inspection capabilities from actual data plane payload access.
3
Reject overly permissive configurations and improper control mechanisms.
Primitive roles (Viewer/Editor), administrative service account privileges, and network-level perimeters fail to enforce proper identity-based data access restrictions.
Relying on primitive roles or administrative grants introduces unnecessary privilege risks that breach strict organizational compliance controls.

Key Concept

IAM Policy Inheritance and Predefined Security Roles in Google Cloud Resource Hierarchy
Rate this question

Topics

Identity and Access Management (IAM) Roles and Resource Hierarchy