Examkin

Soru

Zorluk: ZorManaging IAM Roles and Resource Access Permissions

A CI/CD pipeline service account must be configured to build container images, store them in Google Cloud Artifact Registry, and deploy them to Cloud Run services within a dedicated staging project. To adhere strictly to the principle of least privilege without using primitive roles, which TWO predefined IAM roles should be granted to the service account on the project? (Select TWO.)

  1. Artifact Registry Writer (roles/artifactregistry.writer)Cevap
  2. Cloud Run Developer (roles/run.developer)Cevap
  3. C
    Editor (roles/editor)
  4. D
    Cloud Run Admin (roles/run.admin) granted at the Organization level

Cevap

To allow a automated service account to manage container artifacts and deploy Cloud Run applications under least privilege, grant Artifact Registry Writer (roles/artifactregistry.writer) and Cloud Run Developer (roles/run.developer) at the project level.
The correct options are Artifact Registry Writer (roles/artifactregistry.writer) and Cloud Run Developer (roles/run.developer). Artifact Registry Writer provides the exact permissions needed to build and push container images to repositories. Cloud Run Developer provides permissions to deploy and update Cloud Run services. Together, these predefined roles enforce the principle of least privilege at the project level.

Adım Adım Çözüm

1
Identify artifact management requirements
Pushing container images requires write access to Artifact Registry repositories, satisfied specifically by roles/artifactregistry.writer.
This predefined role grants repository read/write access without granting administrative privileges over Artifact Registry resources.
2
Identify application deployment requirements
Creating and updating Cloud Run deployments requires service creation and revision management, satisfied specifically by roles/run.developer.
This predefined role allows deploying new revisions and services without full IAM or security policy modification capabilities.
3
Validate least-privilege scoping
Applying these two granular predefined roles directly at the target staging project ensures minimum permissions without broad primitive assignment or excessive resource hierarchy inheritance.
Google Cloud IAM best practices dictate using specific predefined roles over primitive roles (Editor/Owner) and scoping roles to the narrowest required resource level.

Anahtar Kavram

Applying least-privilege IAM access control using granular predefined roles for service workload deployments.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Managing IAM Roles and Resource Access Permissions

Bu konudan daha fazla soru