Examkin

Soru

Zorluk: OrtaManaging IAM Roles and Permissions

An enterprise security compliance policy requires an external auditing team to be granted read-only access to log files in a specific Cloud Storage bucket and query access to a specific BigQuery dataset in a production project. To strictly adhere to the Principle of Least Privilege, which of the following IAM role configurations should you apply? (Select TWO answers.)

  1. Grant the Cloud Storage Object Viewer (roles/storage.objectViewer) role to the auditors on the specific Cloud Storage bucket.Cevap
  2. Grant the BigQuery Data Viewer (roles/bigquery.dataViewer) role to the auditors on the specific BigQuery dataset.Cevap
  3. C
    Grant the Viewer (roles/viewer) primitive role to the auditors at the Google Cloud project level.
  4. D
    Grant the Cloud Storage Object Viewer (roles/storage.objectViewer) role to the auditors at the parent Folder level.

Cevap

Assigning predefined roles (roles/storage.objectViewer and roles/bigquery.dataViewer) directly at the specific resource levels (bucket and dataset) satisfies the access requirements while maintaining the Principle of Least Privilege.
Granting predefined roles directly on the individual target resources (Cloud Storage Object Viewer on the bucket and BigQuery Data Viewer on the dataset) enforces the Principle of Least Privilege by restricting access strictly to the requested data assets.

Adım Adım Çözüm

1
Determine the required access scope for the Cloud Storage requirement.
The principal needs object read access for one bucket.
Binding roles/storage.objectViewer directly to the bucket restricts access exclusively to that bucket.
2
Determine the required access scope for the BigQuery requirement.
The principal needs table query and read access for one dataset.
Binding roles/bigquery.dataViewer directly to the dataset restricts access exclusively to that dataset.
3
Evaluate potential distractor role assignments against least privilege.
Avoid project-level primitive roles and folder-level policy bindings.
Primitive roles grant overly broad project-wide rights, and folder bindings inherit access across all child resources.

Anahtar Kavram

Applying least-privilege access control by granting predefined IAM roles at specific resource levels rather than using primitive roles or binding roles higher in the resource hierarchy.
Bu soruyu puanla

Konular

Managing IAM Roles and Permissions

Bu konudan daha fazla soru