Examkin

Soru

Zorluk: OrtaManaging IAM Roles and Resource Access Permissions

An organization requires a security audit service account to review configuration settings for Compute Engine virtual machines and BigQuery datasets across all projects within a folder. The service account must be able to inspect resource metadata and settings, but must NOT be allowed to read table data inside BigQuery or interact with VM guest OS instances. Which TWO predefined IAM roles should be granted to the service account at the folder level to satisfy the principle of least privilege? (Select TWO answers.)

  1. Compute Viewer (roles/compute.viewer)Cevap
  2. BigQuery Metadata Viewer (roles/bigquery.metadataViewer)Cevap
  3. C
    Editor (roles/editor)
  4. D
    Viewer (roles/viewer)

Cevap

The correct roles to grant are Compute Viewer (roles/compute.viewer) and BigQuery Metadata Viewer (roles/bigquery.metadataViewer).
Granting Compute Viewer (roles/compute.viewer) and BigQuery Metadata Viewer (roles/bigquery.metadataViewer) perfectly fulfills the security requirements. Compute Viewer allows inspecting VM configurations without granting interactive access or write permissions. BigQuery Metadata Viewer allows listing and viewing dataset schemas and table metadata while explicitly withholding access to actual table contents.

Adım Adım Çözüm

1
Analyze the requirements for Compute Engine access.
The requirement specifies inspecting VM configurations without interactive access, which maps directly to the predefined Compute Viewer role.
Compute Viewer (roles/compute.viewer) grants permission to list and view VM properties without granting SSH or modification capabilities.
2
Analyze the requirements for BigQuery access.
The requirement specifies reading dataset and table metadata while strictly prohibiting access to table data, which maps directly to BigQuery Metadata Viewer.
BigQuery Metadata Viewer (roles/bigquery.metadataViewer) exposes dataset structures and table schemas without granting table data read permissions.
3
Evaluate and eliminate primitive roles.
Primitive roles like Editor and Viewer are eliminated because they grant overly broad permissions across all services.
Google Cloud security best practices mandate using granular predefined or custom roles over primitive roles to maintain least privilege.

Anahtar Kavram

Selecting predefined IAM roles to enforce least privilege access controls
Bu soruyu puanla

Konular

Managing IAM Roles and Resource Access Permissions

Bu konudan daha fazla soru