Examkin

Soru

Zorluk: ZorManaging IAM Roles and Permissions

An organization requires a third-party security auditor service account to review configuration settings and read log archives stored inside a single designated Cloud Storage bucket (`sec-audit-logs-2026`) located within the `analytics-prod` project. The auditor must not be able to view objects in any other buckets, nor should they have permissions to alter or delete any resources. Following Google Cloud best practices and the Principle of Least Privilege, how should you grant the necessary permissions?

  1. Grant the predefined role Storage Object Viewer (`roles/storage.objectViewer`) directly on the `sec-audit-logs-2026` Cloud Storage bucket.Cevap
  2. B
    Grant the primitive Viewer role (`roles/viewer`) on the `analytics-prod` project resource.
  3. C
    Grant the predefined role Storage Object Viewer (`roles/storage.objectViewer`) at the parent Folder level containing the `analytics-prod` project.
  4. D
    Grant the primitive Editor role (`roles/editor`) directly on the `sec-audit-logs-2026` Cloud Storage bucket.

Cevap

Grant the predefined role Storage Object Viewer (`roles/storage.objectViewer`) directly on the `sec-audit-logs-2026` Cloud Storage bucket.
Binding the predefined role Storage Object Viewer directly to the designated bucket follows the Principle of Least Privilege by restricting access strictly to the requested bucket resource without granting excessive project-wide permissions or write capabilities.

Adım Adım Çözüm

1
Identify required permissions and access scope
Read-only access to objects inside a single Cloud Storage bucket (`sec-audit-logs-2026`).
The scenario explicitly restricts access to a single bucket without permitting access to other buckets or resource modifications.
2
Select the appropriate role type
Predefined role `roles/storage.objectViewer` instead of primitive roles (`roles/viewer` or `roles/editor`).
Predefined roles provide narrow, task-specific permissions, adhering to the Principle of Least Privilege.
3
Determine the resource hierarchy binding target
Bind the role directly to the bucket resource rather than project or folder level.
IAM permissions are inherited down the resource hierarchy. Binding at the bucket level prevents permission leakage to other resources in the project or folder.

Anahtar Kavram

Applying IAM policy bindings at the specific resource level using predefined roles to enforce least privilege.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Managing IAM Roles and Permissions

Bu konudan daha fazla soru