Soru

Zorluk: OrtaManaging IAM Roles and Permissions

An analytics team needs to execute BigQuery SQL queries within project `proj-analytics-881` and read raw data files stored in a specific Cloud Storage bucket named `gs://raw-telemetry-2026`. The security administrator must configure access adhering strictly to the principle of least privilege. Which TWO IAM role bindings should be granted?

  1. Grant the BigQuery Job User role (`roles/bigquery.jobUser`) to the analytics team on project `proj-analytics-881`.Cevap
  2. Grant the Storage Object Viewer role (`roles/storage.objectViewer`) to the analytics team specifically on the `gs://raw-telemetry-2026` bucket.Cevap
  3. C
    Grant the Editor primitive role (`roles/editor`) to the analytics team on project `proj-analytics-881`.
  4. D
    Grant the Storage Admin role (`roles/storage.admin`) to the analytics team at the Organization level.

Cevap

Grant the BigQuery Job User role (`roles/bigquery.jobUser`) on project `proj-analytics-881` and grant the Storage Object Viewer role (`roles/storage.objectViewer`) on the specific Cloud Storage bucket `gs://raw-telemetry-2026`.
To satisfy least privilege requirements, the team should receive the BigQuery Job User role (`roles/bigquery.jobUser`) at the project level to execute queries, and the Storage Object Viewer role (`roles/storage.objectViewer`) applied directly to the designated bucket `gs://raw-telemetry-2026` to read target files without accessing other project resources.

Adım Adım Çözüm

1
Identify the minimum predefined role required to run BigQuery jobs within the target project.
The BigQuery Job User role (`roles/bigquery.jobUser`) enables executing queries without granting project-wide data modification privileges.
Running queries requires job creation and execution permissions at the project level.
2
Identify the minimum predefined role required to read files from a single Cloud Storage bucket.
The Storage Object Viewer role (`roles/storage.objectViewer`) bound directly to `gs://raw-telemetry-2026` grants read access exclusively to that specific bucket.
Binding roles at the resource level prevents exposing other storage buckets in the project or organization.

Anahtar Kavram

Applying least privilege through predefined role selection and resource-level IAM policy bindings.
Bu soruyu puanla