An organization is establishing access controls for an automated infrastructure deployment pipeline and a finance audit team. A service account named `[email protected]` requires permissions to fully manage Compute Engine virtual machine instances only within the target project `prod-core`. Simultaneously, a compliance auditor needs read-only access to inspect spending trends and invoice data on the Billing Account associated with `prod-core`, without permission to modify billing configurations or manage project resources. Which IAM role configurations adhere to Google Cloud best practices and the principle of least privilege? (Select TWO.)
- Grant `roles/compute.instanceAdmin.v1` to `[email protected]` on the `prod-core` project resource.Cevap
- BGrant `roles/editor` to `[email protected]` on the `prod-core` project resource.
- Grant `roles/billing.viewer` to the compliance auditor user directly on the Billing Account resource.Cevap
- DGrant `roles/billing.admin` to the compliance auditor user on the `prod-core` project resource.
Cevap
Grant `roles/compute.instanceAdmin.v1` to the service account on the target project resource, and grant `roles/billing.viewer` to the compliance auditor directly on the Billing Account resource.
The correct options implement least-privilege security principles by granting targeted predefined roles at the appropriate levels of the GCP resource hierarchy. Assigning Compute Instance Admin (v1) at the project level gives the service account necessary permissions for instance management without project-wide Editor rights. Assigning Billing Account Viewer directly on the Billing Account resource provides the auditor with read-only cost visibility without administrative mutation permissions.
Adım Adım Çözüm
Anahtar Kavram
Applying least-privilege predefined roles at correct resource hierarchy nodes (Project vs Billing Account).