Examkin

Question

Difficulty: HardIdentity and Access Management (IAM) Roles and Resource Hierarchy

A telecommunications enterprise organizes its Google Cloud resource hierarchy using an Organization node containing a parent folder named Telematics-Platform, which holds two sub-folders: Connected-Fleet-Prod and Connected-Fleet-Staging. External operational contractors require permissions to deploy Compute Engine instances and configure instance templates inside projects under Connected-Fleet-Prod only. The instances must run using specific existing service accounts. The security policy mandates strict adherence to the principle of least privilege, preventing contractors from modifying service account identity policies or accessing staging workloads. How should the principal cloud architect grant the required permissions?

  1. Grant the Compute Instance Admin (v1) role to the contractors' Google group on the Connected-Fleet-Prod folder, and grant the Service Account User role to the group on the specific workload service accounts.Answer
  2. B
    Grant the Editor primitive role to the contractors' Google group on the Telematics-Platform parent folder.
  3. C
    Grant the Compute Instance Admin (v1) role and the Service Account Admin role to the contractors' Google group on the Connected-Fleet-Prod folder.
  4. D
    Grant the Compute Instance Admin (v1) role to the contractors' Google group on the Connected-Fleet-Prod folder and configure a VPC Service Controls perimeter around the folder without granting IAM service account permissions.

Answer

Grant the Compute Instance Admin (v1) role to the contractors' Google group on the Connected-Fleet-Prod folder, and grant the Service Account User role to the group on the specific workload service accounts.
The solution requiring Compute Instance Admin (v1) at the Connected-Fleet-Prod folder level and Service Account User on specific target service accounts adheres strictly to least privilege. Scoping the compute role at the specific sub-folder prevents access to Connected-Fleet-Staging, while granting Service Account User permits contractors to launch instances under the workload identity without conferring administrative management over the service accounts.

Step-by-Step Solution

1
Analyze resource hierarchy boundaries for compute administration
Scoping Compute Instance Admin (v1) to the Connected-Fleet-Prod folder ensures contractors cannot access or modify instances within Connected-Fleet-Staging or parent folder levels.
IAM permissions inherit downward. Placing the binding at the sub-folder level isolates production resources while satisfying operational scope requirements.
2
Determine minimum required role for running workloads under service account identities
The Service Account User role (roles/iam.serviceAccountUser) allows principals to bind service accounts to compute resources.
Service Account User provides execution/impersonation permissions without permitting IAM policy modification or key creation on the service account.
3
Evaluate distractor security anti-patterns
Reject primitive roles, administrative service account roles, and relying solely on VPC Service Controls for identity authorization.
Least privilege mandates avoiding administrative rights over identity management and avoiding broad inherited primitive roles.

Key Concept

Resource Hierarchy Scoping and Service Account User Authorization
Estimated Time:2m 0s
Rate this question

Topics

Identity and Access Management (IAM) Roles and Resource Hierarchy