Examkin

Soru

Zorluk: ZorManaging IAM Roles and Permissions

A central data operations team is configuring access permissions for a contract analyst. The analyst requires permissions to run SQL query jobs and view dataset contents within a single Google Cloud project named `analytics-prod-883`, without permissions to edit data, delete tables, or manage infrastructure. In accordance with the principle of least privilege, which TWO predefined IAM roles should be granted to the analyst on the `analytics-prod-883` project?

  1. BigQuery Job User (roles/bigquery.jobUser)Cevap
  2. BigQuery Data Viewer (roles/bigquery.dataViewer)Cevap
  3. C
    Editor (roles/editor)
  4. D
    BigQuery Admin (roles/bigquery.admin) granted at the parent Folder resource level

Cevap

The contract analyst should be assigned the predefined roles BigQuery Job User (roles/bigquery.jobUser) and BigQuery Data Viewer (roles/bigquery.dataViewer) scoped directly to the target project.
Running queries and viewing dataset contents in BigQuery requires two distinct permissions in GCP IAM: permission to execute jobs within the project and permission to read dataset contents. Assigning BigQuery Job User (roles/bigquery.jobUser) provides job execution access, and BigQuery Data Viewer (roles/bigquery.dataViewer) grants read-only dataset access at the project scope.

Adım Adım Çözüm

1
Identify the required permissions for running queries and reading table data.
The user needs job execution permissions and read-only dataset access.
BigQuery separates job running permissions from data access permissions.
2
Map required permissions to predefined roles that uphold least privilege.
roles/bigquery.jobUser allows creating and running query jobs; roles/bigquery.dataViewer allows reading datasets and tables.
Predefined roles grant only the specific permissions needed for job execution and data viewing.
3
Evaluate resource scope boundaries.
Roles must be granted at the project level analytics-prod-883 rather than at folder/organization scope or using broad primitive roles.
Inheritance from parent folders or using primitive roles grants excessive scope and administrative capabilities.

Anahtar Kavram

Applying least privilege for BigQuery operations using project-scoped predefined roles
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Managing IAM Roles and Permissions

Bu konudan daha fazla soru