Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM) Roles and Resource Hierarchy

A global gaming company structures its Google Cloud resource hierarchy with an Organization node containing top-level folders named Game-Services and Corporate-IT. The infrastructure team needs to grant a group of site reliability engineers (SREs) full administrative access to Compute Engine resources across all current and future projects nested inside the Game-Services folder. The security team requires strict compliance with the principle of least privilege while minimizing management overhead. Which IAM assignment strategy should be implemented?

  1. Grant the Compute Admin role (roles/compute.admin) to the SRE group at the Game-Services folder level.Answer
  2. B
    Grant the Editor primitive role (roles/editor) to the SRE group at the Game-Services folder level.
  3. C
    Grant the Service Account Admin role (roles/iam.serviceAccountAdmin) to the SRE group at the Game-Services folder level.
  4. D
    Grant IAM permissions at the individual project level and configure VPC Service Controls to restrict Compute Engine management across folders.

Answer

Grant the Compute Admin role (roles/compute.admin) to the SRE group at the Game-Services folder level.
In Google Cloud IAM, policies applied at a folder node are inherited by all resource containers beneath it, including current and future projects. Assigning the predefined Compute Admin role (roles/compute.admin) at the Game-Services folder level satisfies least privilege for Compute Engine resources while eliminating the administrative burden of granting per-project permissions.

Step-by-Step Solution

1
Identify the required scope and permissions
Permissions must grant full management over Compute Engine resources across all nested projects in the Game-Services folder.
SREs need to manage compute resources across all existing and future projects within that specific folder branch.
2
Apply Google Cloud resource hierarchy inheritance rules
Granting roles at a parent folder level propagates permissions down to all existing and future child projects automatically.
This satisfies the requirement to minimize operational management overhead when projects are added.
3
Select the appropriate IAM role adhering to least privilege
The predefined role Compute Admin (roles/compute.admin) provides full control of Compute Engine resources without granting access to unrelated GCP services.
Primitive roles like Editor grant excessive broad access, violating security requirements.

Key Concept

Resource Hierarchy IAM Policy Inheritance and Predefined Roles
Estimated Time:1m 30s
Rate this question

Topics

Identity and Access Management (IAM) Roles and Resource Hierarchy