Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM) Roles and Resource Hierarchy

An enterprise cloud security architect is auditing how access rights are evaluated across a Google Cloud environment. When a principal attempts an action on a specific resource, IAM permissions are evaluated along the resource hierarchy. Arrange the following evaluation steps in the correct order, starting from the highest ancestor node in the hierarchy down to the specific target resource.

  1. 1Evaluate Organization-level IAM policy bindings applied at the root node.
  2. 2Evaluate Folder-level IAM policy bindings across nested parent folders.
  3. 3Evaluate Project-level IAM policy bindings on the containing project.
  4. 4Evaluate Resource-level IAM policy bindings attached directly to the specific resource.

Answer

The correct sequence for IAM policy inheritance and evaluation moves down the resource hierarchy: Organization level -> Folder level -> Project level -> Resource level.
Google Cloud IAM follows a strict top-down resource hierarchy structure (Organization -> Folder -> Project -> Resource). Policies set at any node in the hierarchy are inherited by all of its descendants. Therefore, evaluating effective permissions begins at the Organization level, proceeds through parent Folders, checks Project bindings, and concludes at the specific Resource level.

Step-by-Step Solution

1
Identify the top-most root node of the Google Cloud resource hierarchy.
Organization-level IAM policies are evaluated first as the root ancestor.
Permissions granted at the organization level inherit down to all child nodes in the organization tree.
2
Trace policy inheritance through intermediate grouping containers.
Folder-level IAM policies are evaluated next along the parent folder path.
Folders allow grouping projects and inherit policies from the organization while passing them to child projects.
3
Evaluate access at the project container level.
Project-level IAM policies are evaluated.
Projects contain individual resources and inherit all permissions assigned at organization and folder ancestors.
4
Check permissions directly attached to the target service instance.
Resource-level IAM policies are evaluated to determine final effective access.
Fine-grained permissions can be bound directly to specific resources like BigQuery datasets or Cloud Storage buckets.

Key Concept

Google Cloud IAM Policy Inheritance and Resource Hierarchy Evaluation
Estimated Time:1m 30s
Rate this question

Topics

Identity and Access Management (IAM) Roles and Resource Hierarchy