An enterprise organization manages its workloads in Google Cloud using a resource hierarchy consisting of an Organization node, a top-level Folder named 'Production-Apps', and a nested sub-folder named 'PCI-Compliant-Workloads'. An administrator previously granted an auditing group the 'Compute Viewer' (roles/compute.viewer) role at the 'Production-Apps' folder level. The security team now requires that this auditing group be prevented from viewing Compute Engine instances inside the 'PCI-Compliant-Workloads' folder, while maintaining their viewer access across all other projects in 'Production-Apps'. A cloud engineer attempts to remove the group's 'Compute Viewer' role binding directly on the 'PCI-Compliant-Workloads' folder, but group members are still able to list and view all Compute Engine resources within that sub-folder. Which statement accurately explains why this access persists and describes the correct administrative remedy?
- IAM permissions in Google Cloud are strictly additive and inherited down the resource hierarchy; inherited permissions cannot be revoked or denied at a lower hierarchy node. To restrict access, remove the folder-level role binding from 'Production-Apps' and grant 'Compute Viewer' only on the specific child projects or sub-folders where access is permitted.Cevap
- BIAM policy inheritance is subtractive by default; removing a role at a child folder level only takes effect if an Organization Policy constraint explicitly enables IAM Policy Inheritance Overrides at the sub-folder level.
- CThe group retains access because revoking an inherited role at a child node requires defining an explicit Deny policy at the project level, as child folder removals do not override parent folder permissions.
- DThe inherited role cannot be modified at the sub-folder level because the group was assigned a predefined role instead of a primitive role; predefined roles lock inherited permissions across all child folders.