Examkin

Soru

Zorluk: OrtaManaging IAM Roles and Resource Access Permissions

An enterprise organization is setting up a new Google Cloud environment. A finance specialist needs permission to link newly created cloud projects to the company's central Cloud Billing Account. The specialist must not be allowed to modify payment methods, manage billing account admins, or view cost reports for other projects linked to the account. Which predefined IAM role should be assigned to the finance specialist on the Cloud Billing Account resource to satisfy the principle of least privilege?

  1. Billing Account User (roles/billing.user)Cevap
  2. B
    Billing Account Administrator (roles/billing.admin)
  3. C
    Billing Account Viewer (roles/billing.viewer)
  4. D
    Project Billing Manager (roles/billing.projectManager)

Cevap

Billing Account User (roles/billing.user)
The Billing Account User (roles/billing.user) role allows users to associate projects with a Cloud Billing Account. When granted on the billing account level, it fulfills the requirement of allowing project linking while strictly withholding administrative permissions over payment settings or billing account configuration.

Adım Adım Çözüm

1
Identify the minimum permission required for linking a project to a billing account.
The user requires the billing.resourceAssociations.create permission on the Cloud Billing Account resource.
Linking a project to a billing account requires access rights on the billing account itself.
2
Evaluate predefined IAM roles scoped to the Cloud Billing Account resource against least privilege rules.
Billing Account User (roles/billing.user) grants project association rights without administrative or viewing access to unrelated billing data.
Overly permissive roles like Billing Account Administrator grant sensitive management privileges, while Billing Account Viewer lacks write/association capabilities.

Anahtar Kavram

Least privilege IAM role selection for Google Cloud Billing Accounts
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Managing IAM Roles and Resource Access Permissions

Bu konudan daha fazla soru