Examkin

Question

Difficulty: Very hardIdentity and Access Management (IAM) Roles and Resource Hierarchy

A financial enterprise uses a Google Cloud resource hierarchy structured with an Organization node, top-level environment folders named Production and Staging, and multiple project nodes under each folder. The security team needs to allow an external auditing team to view compute resources and monitoring metrics across all current and future production workloads without administrative rights. Concurrently, software developers working in the Staging environment must deploy Compute Engine instances configured to run under dedicated service accounts, but must not be capable of creating service accounts or modifying security policies. Which TWO architecture choices should you implement to meet these requirements while upholding least privilege and minimizing administrative overhead? (Select TWO.)

  1. Grant the external auditing principal the predefined compute viewer (roles/compute.viewer) and monitoring viewer (roles/monitoring.viewer) roles bound at the Production folder level.Answer
  2. Grant the software developers the compute instance admin role (roles/compute.instanceAdmin.v1) on the Staging projects and the service account user role (roles/iam.serviceAccountUser) directly on the specific dedicated service accounts.Answer
  3. C
    Grant the external auditing principal the primitive viewer role (roles/viewer) at the Organization node level.
  4. D
    Grant the software developers the service account admin role (roles/iam.serviceAccountAdmin) at the Staging project level.

Answer

Grant compute viewer and monitoring viewer roles at the Production folder level for auditing, and assign compute instance admin on Staging projects with service account user rights bound directly to the target service account resources for developers.
Binding fine-grained predefined roles (compute viewer and monitoring viewer) at the folder level ensures that access policies automatically propagate to all present and future projects under that folder without granting unnecessary access to non-production environments or other GCP services. Additionally, assigning the service account user role specifically on target service account resources allows compute instances to be instantiated under that identity while preventing developers from impersonating unapproved service accounts or modifying IAM policies.

Step-by-Step Solution

1
Analyze resource hierarchy requirements for the external auditing team
Identified that permissions granted at the Production folder level inherit downwards to all child projects, automatically covering future resources without requiring primitive Viewer access at the Organization level.
Google Cloud IAM follows top-down inheritance down the resource hierarchy (Organization -> Folder -> Project -> Resource).
2
Evaluate service account access controls for developers
Determined that developers require roles/compute.instanceAdmin.v1 to provision VMs and roles/iam.serviceAccountUser to attach service accounts to those VMs.
Attaching a service account to a Compute Engine instance requires the serviceAccountUser role on that specific service account identity.
3
Apply the principle of least privilege to both access requirements
Bound specific predefined viewer roles at the folder scope and bound roles/iam.serviceAccountUser directly on the target service account resources rather than project-wide admin roles.
Resource-level IAM bindings prevent arbitrary identity misuse and guard against unauthorized privilege escalation.

Key Concept

IAM Resource Hierarchy Inheritance and Service Account Least Privilege
Rate this question

Topics

Identity and Access Management (IAM) Roles and Resource Hierarchy