Examkin

Soru

Zorluk: OrtaManaging IAM Roles and Resource Access Permissions

An enterprise operations team requires access to inspect Cloud Logging logs and view Cloud Monitoring metrics for resources in a specific project without permission to modify infrastructure or view underlying application datasets. To adhere to Google Cloud best practices for least privilege, which TWO predefined IAM roles should you grant to the operations team members? (Select TWO.)

  1. Logs Viewer (`roles/logging.viewer`) granted at the project levelCevap
  2. Monitoring Viewer (`roles/monitoring.viewer`) granted at the project levelCevap
  3. C
    Project Viewer (`roles/viewer`) granted at the project level
  4. D
    Compute Viewer (`roles/compute.viewer`) granted at the Organization level to override project-level permissions

Cevap

To allow the operations team to view logs and monitoring metrics under the principle of least privilege, grant the Logs Viewer (`roles/logging.viewer`) and Monitoring Viewer (`roles/monitoring.viewer`) predefined roles at the project level.
Granting Logs Viewer (`roles/logging.viewer`) and Monitoring Viewer (`roles/monitoring.viewer`) enforces least privilege by restricting access specifically to log entries and monitoring metrics without granting broad access to underlying datasets or infrastructure configuration.

Adım Adım Çözüm

1
Identify the specific operational access requirements
The operations team needs read-only access to log entries in Cloud Logging and performance metrics in Cloud Monitoring.
Least privilege mandates granting only the specific roles necessary to complete the required operational tasks.
2
Select fine-grained predefined roles over broad primitive roles
Select Logs Viewer (`roles/logging.viewer`) and Monitoring Viewer (`roles/monitoring.viewer`).
Predefined roles restrict permissions to specific services, whereas the primitive Project Viewer role grants excessive read access across all project resources.
3
Determine correct IAM resource hierarchy placement
Apply role bindings directly at the project level.
IAM permissions are additive and inherit down the hierarchy (Organization > Folder > Project). Granting roles higher up does not restrict lower-level access.

Anahtar Kavram

Selecting predefined IAM roles for Cloud Logging and Cloud Monitoring to enforce the principle of least privilege.
Bu soruyu puanla

Konular

Managing IAM Roles and Resource Access Permissions

Bu konudan daha fazla soru