Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM) Roles and Resource Hierarchy

An enterprise financial company uses a Google Cloud Organization hierarchy containing a parent folder named `Financial-Core-Prod` that holds multiple production projects. The security team needs to grant an external compliance audit firm read-only access to view infrastructure resource configurations, security policies, and IAM bindings across all present and future projects within `Financial-Core-Prod`. The audit firm must not have access to view underlying data inside Cloud Storage buckets or modify any resource configurations. Which IAM assignment strategy meets these requirements while adhering to Google Cloud best practices for resource hierarchy and least privilege?

  1. Grant the predefined `roles/iam.securityReviewer` role to the audit firm's Google Group at the `Financial-Core-Prod` folder level.Answer
  2. B
    Grant the primitive `roles/viewer` role to the audit firm's Google Group at the `Financial-Core-Prod` folder level.
  3. C
    Create a dedicated audit service account, grant it `roles/iam.serviceAccountAdmin` at the Organization level, and download service account keys for the auditors.
  4. D
    Grant `roles/editor` to the auditors on each project individually and rely on VPC Service Controls perimeters to block data exfiltration.

Answer

Grant the predefined role Security Reviewer (roles/iam.securityReviewer) to the auditor Google Group at the folder level.
Granting the predefined Security Reviewer role (`roles/iam.securityReviewer`) to a Google Group at the folder level leverages resource hierarchy inheritance. All current and future projects beneath that folder inherit the policy, allowing auditors to inspect security configurations and resource metadata across the environment without accessing object data or requiring broad primitive roles.

Step-by-Step Solution

1
Identify the scope of access required across multiple projects.
The target scope encompasses all present and future projects under the `Financial-Core-Prod` folder.
Applying the IAM policy at the folder node allows permissions to naturally inherit down to all child project nodes, minimizing operational management overhead.
2
Determine the role that provides security metadata inspection without data access.
The Security Reviewer role (`roles/iam.securityReviewer`) grants permissions to inspect IAM policies, network configurations, and resource metadata without granting access to data payloads.
This adheres strictly to least privilege compared to broad primitive roles or administrative permissions.

Key Concept

Resource Hierarchy Permission Inheritance and Predefined IAM Roles
Rate this question

Topics

Identity and Access Management (IAM) Roles and Resource Hierarchy