Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM) Roles and Resource Hierarchy

A software enterprise is structuring its Google Cloud resource hierarchy with dedicated `Production` and `Non-Production` folders under the Organization node. A third-party compliance team requires read-only visibility into security configurations and IAM policy bindings across all existing and future projects without accessing underlying data payloads. Simultaneously, an automated CI/CD pipeline needs permission to launch Compute Engine instances in `Non-Production` projects using a specific managed workload service account, without granting the pipeline administrative rights to modify service account credentials. Which of the following IAM configuration choices follow Google-recommended best practices for least privilege and resource hierarchy inheritance? (Select TWO.)

  1. Grant the Security Reviewer role (`roles/iam.securityReviewer`) to the third-party compliance group at the Organization level.Answer
  2. Grant the Service Account User role (`roles/iam.serviceAccountUser`) to the CI/CD pipeline identity on the specific workload service account resource.Answer
  3. C
    Grant the primitive Editor role (`roles/editor`) to the third-party compliance group at the Organization level.
  4. D
    Grant the Service Account Admin role (`roles/iam.serviceAccountAdmin`) to the CI/CD pipeline identity at the Non-Production folder level.

Answer

The optimal approach is to grant the Security Reviewer role to the compliance group at the Organization level, and grant the Service Account User role to the CI/CD pipeline identity on the specific workload service account.
Granting the Security Reviewer role at the Organization level ensures that read-only security visibility inherits across all folders and projects automatically. Furthermore, binding the Service Account User role directly on the specific workload service account limits the CI/CD pipeline's impersonation rights exclusively to the necessary identity without granting administrative power.

Step-by-Step Solution

1
Analyze compliance monitoring requirements across the organization hierarchy.
Assigning `roles/iam.securityReviewer` at the Organization node ensures inherited read-only access to security settings and IAM policies across all child folders and projects without granting access to resource contents or data payloads.
Resource hierarchy inheritance ensures future projects automatically adopt policy bindings set at the parent Organization level.
2
Evaluate deployment pipeline authorization for Compute Engine service account usage.
Granting `roles/iam.serviceAccountUser` specifically on the target workload service account allows the pipeline to bind that service account to new VMs.
Scoping access to the specific service account resource enforces the principle of least privilege, preventing unauthorized service account impersonation or management.

Key Concept

Resource Hierarchy Inheritance and Fine-Grained Service Account Impersonation
Estimated Time:1m 30s
Rate this question

Topics

Identity and Access Management (IAM) Roles and Resource Hierarchy