Examkin

Soru

Zorluk: ZorEnabling and Managing Cloud Service APIs

An enterprise application requires the Secret Manager API (`secretmanager.googleapis.com`) to be activated in a target Google Cloud project named `proj-sec-app`. A service account used by a CI/CD pipeline needs to enable this API and, if necessary, submit a request to raise the default API request quota. Which approach adheres to Google Cloud security best practices and the principle of least privilege?

  1. Grant the service account the Service Usage Admin (`roles/serviceusage.serviceUsageAdmin`) role on `proj-sec-app` to enable the API, and submit a quota increase request via the Service Usage Quotas section in the Cloud Console.Cevap
  2. B
    Grant the service account the Owner (`roles/owner`) role at the organization level so that permissions inherit down to `proj-sec-app` to allow API management.
  3. C
    Enable the Secret Manager API directly at the organization root node using `gcloud services enable`, which automatically enables the API and scales quotas for `proj-sec-app`.
  4. D
    Deploy a new Google Cloud project whenever API request limits are reached in `proj-sec-app`, as project quotas automatically multiply without requiring formal requests.

Cevap

Grant the service account the Service Usage Admin role on the target project to enable the API and request quota increases via the Service Usage Quotas interface.
The predefined role Service Usage Admin (`roles/serviceusage.serviceUsageAdmin`) grants the precise permissions required to list, enable, disable APIs, and view or request quota increases on a project level without giving unnecessary control over other GCP services.

Adım Adım Çözüm

1
Identify the required IAM role for managing APIs.
The Service Usage Admin (`roles/serviceusage.serviceUsageAdmin`) role provides permissions to enable/disable APIs and view/edit quotas.
Predefined roles should always be selected over primitive roles to satisfy least privilege.
2
Determine the correct resource scope for API enablement.
The role must be granted on the target project (`proj-sec-app`).
APIs are scoped to individual projects where workloads execute.
3
Identify the standard workflow for requesting higher quotas.
Quota increases are requested via the IAM & Admin > Quotas page or Service Usage API for the specific project.
Creating new projects to circumvent quota restrictions is an improper administrative anti-pattern.

Anahtar Kavram

Enabling Cloud APIs with Least Privilege IAM Roles and Requesting Resource Quota Increases
Bu soruyu puanla

Konular

Enabling and Managing Cloud Service APIs

Bu konudan daha fazla soru