Examkin

Soru

Zorluk: KolayManaging IAM Roles and Resource Access Permissions

A software developer requires permission to view and read objects within Cloud Storage buckets in a specific Google Cloud project, but must not be able to create, modify, or delete objects. Which IAM role should be assigned to the developer to enforce the principle of least privilege?

  1. Storage Object Viewer (roles/storage.objectViewer)Cevap
  2. B
    Editor (roles/editor)
  3. C
    Storage Admin (roles/storage.admin)
  4. D
    Project Viewer (roles/viewer) at the project level combined with a bucket deny policy

Cevap

Assign the predefined Storage Object Viewer (roles/storage.objectViewer) role.
The Storage Object Viewer role (roles/storage.objectViewer) provides read access to Cloud Storage objects without granting rights to create, edit, delete objects, or manage bucket policies. This satisfies the requirement while following the principle of least privilege.

Adım Adım Çözüm

1
Identify the precise access requirements
The developer only needs to view and read objects within Cloud Storage.
The requirement explicitly restricts creating, modifying, or deleting objects.
2
Select the predefined role matching least privilege
The Storage Object Viewer (roles/storage.objectViewer) role provides exact read-only access to objects.
Google Cloud best practice dictates using specific predefined roles over broad primitive roles or administrative permissions.

Anahtar Kavram

Granting minimal necessary access using predefined Cloud Storage IAM roles.
Tahmini Süre:45s
Bu soruyu puanla

Konular

Managing IAM Roles and Resource Access Permissions

Bu konudan daha fazla soru