Examkin

Soru

Zorluk: KolayManaging IAM Roles and Permissions

Your organization requires an external security auditor to inspect the configurations of Pub/Sub topics and subscriptions in a specific Google Cloud project. The auditor also needs read-only access to inspect the IAM policy bindings configured on that project, but must not be granted permissions to modify any resources or publish/consume messages. Which TWO roles should be assigned to the auditor at the project level to follow the principle of least privilege? (Select TWO.)

  1. Pub/Sub Viewer (`roles/pubsub.viewer`)Cevap
  2. Security Reviewer (`roles/iam.securityReviewer`)Cevap
  3. C
    Editor (`roles/editor`)
  4. D
    Pub/Sub Admin (`roles/pubsub.admin`) applied at the Organization level

Cevap

Assigning Pub/Sub Viewer and Security Reviewer roles at the project level grants the minimum necessary read-only permissions for Pub/Sub configurations and IAM policies.
To satisfy least privilege for inspecting Pub/Sub configurations and IAM policies, specific predefined read-only roles must be selected at the target project level. The Pub/Sub Viewer role allows reviewing topic and subscription properties without modifying them or accessing data payloads. The Security Reviewer role permits auditing IAM bindings and security posture without permission to edit access rights.

Adım Adım Çözüm

1
Identify the required capabilities
The auditor requires read-only metadata access for Pub/Sub resources and read-only inspection access for project IAM security policies.
Least privilege mandates granting only the specific permissions needed for the role.
2
Select the appropriate predefined role for Pub/Sub inspection
Choose Pub/Sub Viewer (`roles/pubsub.viewer`) at the project level.
Predefined roles target specific service permissions, avoiding over-privileged access like message publishing or administrative management.
3
Select the appropriate predefined role for security/IAM inspection
Choose Security Reviewer (`roles/iam.securityReviewer`) at the project level.
Security Reviewer allows viewing IAM policies and configuration state across the project without granting permission to grant or revoke roles.

Anahtar Kavram

Applying principle of least privilege using predefined IAM roles at the narrowest resource scope
Bu soruyu puanla

Konular

Managing IAM Roles and Permissions

Bu konudan daha fazla soru