Examkin

Soru

Zorluk: OrtaManaging Cloud Projects and Resource Hierarchy

A lead developer at a media enterprise needs permission to create new Google Cloud projects within a dedicated department folder named Media-Production. Additionally, these newly created projects must be linked to the company's central Billing Account. Following the principle of least privilege, which configuration of IAM roles should be granted to the lead developer?

  1. Project Creator (roles/resourcemanager.projectCreator) on the Media-Production folder, and Billing Account User (roles/billing.user) on the central Billing Account.Cevap
  2. B
    Editor (roles/editor) at the Organization resource level, and Billing Account Administrator (roles/billing.admin) on the central Billing Account.
  3. C
    Project Creator (roles/resourcemanager.projectCreator) on the Media-Production folder, without any roles assigned on the Billing Account.
  4. D
    Project Creator (roles/resourcemanager.projectCreator) at the Organization level, relying on implicit denial to restrict creation in sibling folders.

Cevap

Granting Project Creator (roles/resourcemanager.projectCreator) on the target folder and Billing Account User (roles/billing.user) on the central Billing Account.
To create a project within a folder and associate it with a billing account, a principal needs `roles/resourcemanager.projectCreator` assigned on the specific folder (to allow project creation in that scope) and `roles/billing.user` assigned on the billing account (to allow linking projects to that billing account). This minimal role assignment adheres strictly to the principle of least privilege.

Adım Adım Çözüm

1
Identify the resource scope for project creation
The developer only needs to create projects under the Media-Production folder, so the role should be applied at the folder level rather than the Organization level.
Applying roles at the folder level scopes permissions to that container and its descendants.
2
Determine the predefined IAM role required for creating projects
The predefined role `roles/resourcemanager.projectCreator` provides `resourcemanager.projects.create` permission.
Using predefined roles enforces least privilege over broad primitive roles like Owner or Editor.
3
Identify permissions required to link projects to a billing account
Linking a project to a Billing Account requires the `Billing Account User` (roles/billing.user) role on the Billing Account resource.
Project creation and billing association require dual-ended permissions: project creation permission in the resource hierarchy and billing link permission on the billing object.

Anahtar Kavram

Resource Hierarchy Scoping and Billing Account Delegation
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Managing Cloud Projects and Resource Hierarchy

Bu konudan daha fazla soru