Examkin

Soru

Zorluk: KolayManaging IAM Roles and Permissions

A data analyst needs to execute query jobs in a Google Cloud project and read table data within a specific BigQuery dataset. Following the principle of least privilege, which TWO IAM roles should be granted to the analyst?

  1. Grant the BigQuery Job User role (roles/bigquery.jobUser) at the project level.Cevap
  2. Grant the BigQuery Data Viewer role (roles/bigquery.dataViewer) at the dataset level.Cevap
  3. C
    Grant the primitive Editor role (roles/editor) at the project level.
  4. D
    Grant the BigQuery Admin role (roles/bigquery.admin) at the organization level.

Cevap

Grant the BigQuery Job User role (roles/bigquery.jobUser) at the project level and grant the BigQuery Data Viewer role (roles/bigquery.dataViewer) at the dataset level.
Executing BigQuery queries requires project-level permissions to create and manage job resources via the BigQuery Job User role, whereas reading dataset contents requires data access permissions granted via the BigQuery Data Viewer role on the specific dataset.

Adım Adım Çözüm

1
Identify the minimum permission required to run query jobs.
The BigQuery Job User role (roles/bigquery.jobUser) allows running query jobs in the project.
Executing queries requires project-level permissions to create job resources.
2
Identify the minimum permission required to read table data in a specific dataset.
The BigQuery Data Viewer role (roles/bigquery.dataViewer) assigned specifically on the target dataset grants read access.
Scoping dataset permissions to the dataset resource itself prevents unnecessary access to other datasets in the project.
3
Verify least privilege compliance against alternative options.
Reject primitive roles and organization-wide scopes.
Primitive roles (Editor) and organization-wide administrative assignments grant excessive access.

Anahtar Kavram

Applying Least-Privilege Predefined IAM Roles and Scoping Resource Hierarchy
Bu soruyu puanla

Konular

Managing IAM Roles and Permissions

Bu konudan daha fazla soru