Examkin

Soru

Zorluk: OrtaManaging IAM Roles and Resource Access Permissions

An enterprise security auditor requires read-only access to inspect the configuration and operational status of Google Kubernetes Engine (GKE) clusters within a Google Cloud project. The auditor must not have permission to modify cluster settings, delete nodes, or deploy workloads. Following Google's recommended security best practices for least privilege, which IAM role should be assigned to the auditor?

  1. Kubernetes Engine Viewer (roles/container.viewer)Cevap
  2. B
    Project Viewer (roles/viewer)
  3. C
    Kubernetes Engine Developer (roles/container.developer)
  4. D
    Kubernetes Engine Cluster Admin (roles/container.clusterAdmin)

Cevap

Kubernetes Engine Viewer (roles/container.viewer)
The Kubernetes Engine Viewer role (roles/container.viewer) grants read-only permissions to view GKE clusters, workloads, and related resources without enabling any modification, creation, or deletion capabilities. This aligns strictly with the principle of least privilege.

Adım Adım Çözüm

1
Analyze the access requirement
The target user requires read-only access to GKE cluster configurations and status without modification rights.
Security auditing requires inspection capabilities without operational control.
2
Evaluate role options against the Principle of Least Privilege
Primitive roles like Project Viewer grant overly broad access across unrelated GCP services. Service-specific administrative or developer roles grant write access to resources.
Google Cloud IAM best practices dictate assigning predefined roles restricted specifically to the target service and requested access level.
3
Select the specific predefined role
Kubernetes Engine Viewer (roles/container.viewer) provides read-only access to GKE resources.
It fulfills the exact requirements without granting excess permissions or broad project-wide visibility.

Anahtar Kavram

Selecting service-specific predefined IAM roles over primitive roles to satisfy least privilege
Tahmini Süre:1m 15s
Bu soruyu puanla

Konular

Managing IAM Roles and Resource Access Permissions

Bu konudan daha fazla soru