Examkin

Question

Difficulty: HardIdentity and Access Management (IAM) Roles and Resource Hierarchy

A retail enterprise organizes its Google Cloud infrastructure using an Organization node containing top-level folders named Staging and Production. The central Security Operations team requires read-only security visibility across all projects in the Production folder. Additionally, an automated deployment service account must create Compute Engine instances within a specific Production project and attach a pre-configured workload service account to those instances. Which TWO actions should a Cloud Architect recommend to fulfill these security requirements while enforcing least privilege and leveraging resource hierarchy inheritance?

  1. Grant the Security Reviewer role (roles/iam.securityReviewer) to the Security Operations group at the Production folder level.Answer
  2. Grant the deployment service account the Compute Instance Admin (v1) role on the project and the Service Account User role (roles/iam.serviceAccountUser) on the specific workload service account.Answer
  3. C
    Grant the Owner primitive role (roles/owner) to the Security Operations group at the Organization node level.
  4. D
    Grant the deployment service account the Service Account Admin role (roles/iam.serviceAccountAdmin) at the Production folder level.

Answer

Granting the Security Reviewer role to the Security Operations group at the Production folder level leverages resource hierarchy inheritance for broad read-only security visibility. Granting the deployment service account Compute Instance Admin on the project and Service Account User on the specific workload service account ensures instance creation and service account attachment adhere strictly to least privilege.
Inheritance down the resource hierarchy ensures that binding the Security Reviewer role at the Production folder level grants security visibility across all child projects. To attach a pre-configured service account to a Compute Engine instance, the deploying identity needs compute creation privileges on the project and the Service Account User role on the specific service account resource being attached.

Step-by-Step Solution

1
Analyze read-only security visibility requirements across the Production folder hierarchy.
Assigning predefined Security Reviewer role at the Production folder level allows all child projects to inherit read-only security monitoring access automatically.
Resource hierarchy inheritance propagates IAM policy bindings down to child nodes, eliminating operational overhead while avoiding primitive role over-granting.
2
Analyze instance provisioning and service account attachment privileges for the deployment service account.
Grant Compute Instance Admin (v1) on the project and Service Account User on the specific target service account.
Attaching a service account to a compute resource requires roles/iam.serviceAccountUser on the target service account resource, not Service Account Admin.

Key Concept

Resource hierarchy IAM permission inheritance and least-privilege role scoping for compute workloads and service accounts
Rate this question

Topics

Identity and Access Management (IAM) Roles and Resource Hierarchy