Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM) Roles and Resource Hierarchy

A financial technology company structures its Google Cloud resources using separate environment folders (`Production` and `Staging`) under an Organization node. A third-party security auditing team requires read-only permissions to inspect security configurations, IAM policies, and asset inventories for all current and future resources inside the `Production` folder. The auditors must not be allowed to modify resource configurations, access application data payloads, or manage service account keys. Which IAM role binding strategy adheres to Google-recommended best practices for least privilege and resource hierarchy management?

  1. A
    Assign the Viewer primitive role (`roles/viewer`) at the `Production` folder level.
  2. B
    Assign the Service Account Admin role (`roles/iam.serviceAccountAdmin`) at the `Production` folder level.
  3. Assign the predefined Security Reviewer role (`roles/iam.securityReviewer`) at the `Production` folder level.Answer
  4. D
    Assign the Security Reviewer role (`roles/iam.securityReviewer`) at the `Production` folder level while relying solely on this IAM role assignment to prevent authorized users from copying data to external storage buckets.

Answer

Assign the predefined Security Reviewer role (`roles/iam.securityReviewer`) at the `Production` folder level.
Assigning the predefined Security Reviewer role (`roles/iam.securityReviewer`) at the folder level grants read-only access to security policies and resource configurations for all current and future projects in that folder through inheritance. This enforces least privilege without operational overhead or granting access to underlying application data.

Step-by-Step Solution

1
Identify the required permissions and resource scope
The requirement specifies read-only access to inspect security configurations across all resources within the `Production` environment folder.
Security auditors need centralized inspection capabilities without access to underlying application data or administrative modification rights.
2
Leverage GCP resource hierarchy inheritance
Binding the IAM role at the `Production` folder level automatically propagates permissions downstream to all child projects and resources.
Inheritance reduces operational overhead by eliminating the need to manage individual IAM bindings on a per-project basis.
3
Select the appropriate predefined IAM role following least privilege
`roles/iam.securityReviewer` grants read-only access to security configurations and IAM policies without exposing underlying data payloads or granting primitive broad access.
Predefined roles offer fine-grained access matching job functions, whereas primitive roles grant excessive read permissions across all services.

Key Concept

Resource Hierarchy IAM Role Inheritance and Least Privilege
Rate this question

Topics

Identity and Access Management (IAM) Roles and Resource Hierarchy