Examkin

Soru

Zorluk: OrtaManaging IAM Roles and Resource Access Permissions

A compliance auditor requires read-only access to query and analyze BigQuery dataset contents across all Google Cloud projects contained within a specific organizational folder. The auditor should not have access to manage project configurations or read data from other GCP services. To adhere to the principle of least privilege while minimizing management overhead, which IAM role configuration should you implement?

  1. Grant the BigQuery Data Viewer role (`roles/bigquery.dataViewer`) to the auditor at the Folder resource level.Cevap
  2. B
    Grant the primitive Viewer role (`roles/viewer`) to the auditor at the Folder resource level.
  3. C
    Grant the BigQuery Data Viewer role (`roles/bigquery.dataViewer`) at the Organization level and apply a Deny policy on other folders.
  4. D
    Grant the Billing Account Viewer role (`roles/billing.viewer`) to the auditor at the Folder resource level.

Cevap

Grant the BigQuery Data Viewer role (`roles/bigquery.dataViewer`) to the auditor at the Folder resource level.
Granting the predefined BigQuery Data Viewer role (`roles/bigquery.dataViewer`) at the Folder level leverages IAM policy inheritance down the resource hierarchy. All current and future projects under that folder will inherit this role, granting the auditor read-only access to BigQuery dataset contents while enforcing the principle of least privilege.

Adım Adım Çözüm

1
Identify the target resource boundary
The requirement specifies access across all projects within a specific organizational folder.
IAM permissions granted at a parent node in the resource hierarchy (Folder) are automatically inherited by child nodes (Projects).
2
Select the appropriate role based on least privilege
Choose `roles/bigquery.dataViewer` over primitive or administrative roles.
The auditor only needs to read dataset contents within BigQuery, so a predefined role tailored specifically to BigQuery data viewing enforces least privilege.
3
Bind the role to the auditor at the Folder level
The auditor gains automatic read-only access to all present and future BigQuery datasets inside all projects under that folder.
This minimizes administrative effort by avoiding individual project-level bindings while restricting scope.

Anahtar Kavram

Resource hierarchy inheritance and predefined role selection for IAM access control
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Managing IAM Roles and Resource Access Permissions

Bu konudan daha fazla soru