Examkin

Soru

Zorluk: OrtaEnabling and Managing Cloud Service APIs

Your enterprise security team requires that all administrative permissions follow the principle of least privilege. An administrator needs to enable the Cloud Translation API (`translate.googleapis.com`) for a project named `finance-reporting-prod` without being granted access to modify project resources, billing accounts, or IAM permissions. Which IAM role should be assigned to the administrator on the project?

  1. Service Usage Admin (roles/serviceusage.serviceUsageAdmin)Cevap
  2. B
    Owner (roles/owner)
  3. C
    Service Usage Admin (roles/serviceusage.serviceUsageAdmin) at the parent Organization level
  4. D
    Quota Administrator (roles/servicemanagement.quotaAdmin)

Cevap

Service Usage Admin (roles/serviceusage.serviceUsageAdmin) granted directly on the target project.
The Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`) provides the necessary permissions (`serviceusage.services.enable` and `serviceusage.services.get`) to enable and manage APIs within a target project without granting unnecessary management access to other Google Cloud resources.

Adım Adım Çözüm

1
Identify the required task and target scope
The task is to enable a Cloud Service API on the specific project `finance-reporting-prod`.
API activation commands and Console operations require service usage management permissions in the specific project context.
2
Evaluate required IAM roles under least privilege principles
The predefined role `roles/serviceusage.serviceUsageAdmin` grants permissions to list, enable, and disable services (`serviceusage.services.enable`).
Using predefined service-specific roles avoids over-granting permissions associated with primitive roles like Owner or Editor.

Anahtar Kavram

Least privilege IAM role selection for GCP API enablement
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Enabling and Managing Cloud Service APIs

Bu konudan daha fazla soru