Examkin

Soru

Zorluk: KolayManaging Cloud Projects and Resource Hierarchy

An administrator grants a cloud engineer the Viewer (roles/viewer) role on a Google Cloud folder named 'Development'. The folder contains three environment projects. The administrator attempts to restrict access by removing the Viewer role from the engineer specifically on one of the child projects. Which statement correctly describes the outcome of this action?

  1. The engineer retains Viewer access to the child project because IAM policies are additive and inherited parent permissions cannot be revoked at a lower resource level.Cevap
  2. B
    The engineer loses Viewer access on that child project because resource-level IAM policies take precedence over inherited folder-level policies.
  3. C
    The engineer loses Viewer access across all projects in the folder because explicitly removing a role from a child resource generates an explicit deny policy.
  4. D
    The engineer retains Viewer access only if they have also been assigned a primitive Owner role at the Organization node level.

Cevap

The engineer retains Viewer access to the child project because IAM policies are additive and inherited parent permissions cannot be revoked at a lower resource level.
In the Google Cloud resource hierarchy, IAM policies are inherited downward from Organization to Folders and then to Projects. Because IAM policy evaluation is strictly additive, permissions granted at a parent level are automatically effective on all child resources and cannot be restricted or revoked at a lower level.

Adım Adım Çözüm

1
Identify where the permission was granted in the resource hierarchy.
The Viewer role was granted at the parent Folder level ('Development').
In GCP, permissions granted at higher resource hierarchy nodes (Organization > Folder > Project) flow downward to all contained child resources.
2
Determine how policy inheritance operates when attempting to modify permissions at a child node.
Attempting to remove the role binding at the child project level does not affect inherited permissions.
Google Cloud IAM policies are strictly additive. Inherited permissions cannot be denied or revoked at a child resource level.

Anahtar Kavram

Resource Hierarchy IAM Policy Inheritance
Bu soruyu puanla

Konular

Managing Cloud Projects and Resource Hierarchy

Bu konudan daha fazla soru