Examkin

Soru

Zorluk: ZorManaging IAM Roles and Permissions

An enterprise data team is configuring IAM permissions for an automated data processing service account. The service account needs to execute BigQuery query jobs and modify table contents only within a single project named `analytics-warehouse-prod`. Security policy mandates strict adherence to the principle of least privilege while preventing permission inheritance across adjacent production projects. Which IAM role assignment strategy should you use?

  1. Grant the BigQuery Job User (`roles/bigquery.jobUser`) and BigQuery Data Editor (`roles/bigquery.dataEditor`) roles to the service account bound specifically at the `analytics-warehouse-prod` project level.Cevap
  2. B
    Grant the primitive Editor (`roles/editor`) role to the service account bound at the `analytics-warehouse-prod` project level.
  3. C
    Grant the BigQuery Data Editor (`roles/bigquery.dataEditor`) role to the service account bound at the parent Folder level containing all production projects.
  4. D
    Grant the BigQuery Admin (`roles/bigquery.admin`) role to the service account bound at the Organization root level.

Cevap

Grant the predefined BigQuery Job User and BigQuery Data Editor roles specifically at the target project level.
Combining the predefined roles BigQuery Job User and BigQuery Data Editor at the project scope satisfies all operational requirements (running jobs and modifying tables) while adhering to the principle of least privilege and scoping access strictly to the intended project.

Adım Adım Çözüm

1
Identify the minimum necessary permissions required for the task.
Running jobs requires BigQuery Job User permissions, and writing table data requires BigQuery Data Editor permissions.
Selecting granular predefined roles avoids granting unnecessary administrative or broad resource permissions.
2
Determine the narrowest resource scope for the binding.
Bind the roles specifically on the target project (`analytics-warehouse-prod`).
Assigning permissions at the project level prevents unwanted access inheritance to other projects within the parent folder or organization.

Anahtar Kavram

Applying Least Privilege using Predefined IAM Roles and Appropriate Resource Hierarchy Scope
Bu soruyu puanla

Konular

Managing IAM Roles and Permissions

Bu konudan daha fazla soru