Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM) Roles and Resource Hierarchy

A global logistics company uses Google Cloud folders to organize regional workloads, with separate folders named Logistics-EU and Logistics-NA under the organization node. An internal security audit team requires permission to inspect IAM access policies and asset security configurations across all current and future projects located inside the Logistics-EU folder. The team must not have access to view underlying customer data stored inside Cloud Storage buckets or BigQuery datasets, and solution management overhead must be minimized. Which IAM role assignment strategy should you implement?

  1. Grant the predefined Security Reviewer role (roles/iam.securityReviewer) on the Logistics-EU folder.Answer
  2. B
    Grant the primitive Viewer role (roles/viewer) on the Logistics-EU folder.
  3. C
    Grant the Service Account User role (roles/iam.serviceAccountUser) individually on each project inside the Logistics-EU folder.
  4. D
    Create a VPC Service Controls perimeter around the Logistics-EU folder and add the security audit team to the perimeter access policy.

Answer

Grant the predefined Security Reviewer role (roles/iam.securityReviewer) on the Logistics-EU folder.
Granting the predefined Security Reviewer role (roles/iam.securityReviewer) at the Logistics-EU folder level uses resource hierarchy inheritance to grant policy and security metadata inspection capabilities across all child projects. It fulfills least privilege by strictly excluding permissions to view underlying resource data.

Step-by-Step Solution

1
Identify the required permissions for security policy auditing
The audit team requires security metadata and policy inspection permissions without access to data plane contents.
Least privilege mandates avoiding broad data view permissions when only policy auditing is required.
2
Select the appropriate IAM role type
The predefined role `roles/iam.securityReviewer` grants read-only access to security policies, IAM configurations, and resource metadata without granting access to data payload contents.
Predefined security roles target specific administrative control capabilities while avoiding over-privileged primitive roles.
3
Determine the resource hierarchy binding level
Binding the role at the `Logistics-EU` folder node automatically inherits permissions down to all existing and future child projects under that folder.
Inheritance via resource hierarchy eliminates administrative overhead associated with manual per-project role bindings.

Key Concept

Resource Hierarchy IAM Role Inheritance and Least Privilege Security Roles
Estimated Time:1m 30s
Rate this question

Topics

Identity and Access Management (IAM) Roles and Resource Hierarchy