Examkin

Soru

Zorluk: OrtaManaging Cloud Projects and Resource Hierarchy

A central cloud administrator needs to authorize a lead developer to provision new Google Cloud projects restricted exclusively within a specific folder named "Mobile-Apps" and link those newly created projects to the corporate Billing Account. Adhering to the principle of least privilege, which of the following IAM role assignments are required to accomplish this setup? (Select TWO correct answers.)

  1. Grant the lead developer the Project Creator role (roles/resourcemanager.projectCreator) on the Mobile-Apps folder.Cevap
  2. Grant the lead developer the Billing Account User role (roles/billing.user) on the corporate Billing Account.Cevap
  3. C
    Grant the lead developer the Owner role (roles/owner) on the Organization resource.
  4. D
    Grant the lead developer the Folder Admin role (roles/resourcemanager.folderAdmin) on the Mobile-Apps folder to grant billing linking capabilities.
  5. E
    Grant the lead developer the Project Creator role (roles/resourcemanager.projectCreator) on the root Organization node, and revoke it on all other folders.

Cevap

Assign the Project Creator role on the target folder (Mobile-Apps) and the Billing Account User role on the corporate Billing Account.
To allow creating projects restricted strictly inside a folder and linking them to billing under least privilege, two specific roles are required: the Project Creator role on the specific destination folder and the Billing Account User role directly on the Billing Account.

Adım Adım Çözüm

1
Determine folder-level project creation permissions
Identify that assigning Project Creator bound to the specific folder scopes project creation rights to that container.
Granting project creation rights at the target folder level ensures project creation is restricted strictly within that folder while enforcing least privilege.
2
Determine billing linking requirements
Identify that the Billing Account User role must be assigned directly on the target Billing Account.
Linking any newly created project to a billing account requires authorization granted on the billing account resource itself.

Anahtar Kavram

Folder-level scoped project creation and billing account IAM binding for least-privilege administrative delegation.
Bu soruyu puanla

Konular

Managing Cloud Projects and Resource Hierarchy

Bu konudan daha fazla soru