Examkin

Soru

Zorluk: OrtaEnabling and Managing Cloud Service APIs

Your organization is initializing a new Google Cloud project named `analytics-prod-12` to deploy containerized application workloads. A Cloud Engineer needs to enable the Cloud Run API (`run.googleapis.com`) for `analytics-prod-12` using the `gcloud` CLI while strictly adhering to the principle of least privilege. Which command and IAM role grant should the engineer use to successfully enable the service API?

  1. Grant the engineer the Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`) on `analytics-prod-12`, and execute `gcloud services enable run.googleapis.com --project=analytics-prod-12`.Cevap
  2. B
    Grant the engineer the Project Owner role (`roles/owner`) on `analytics-prod-12`, and execute `gcloud services enable run.googleapis.com --project=analytics-prod-12`.
  3. C
    Grant the engineer the Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`) on the parent Folder, and execute `gcloud services enable run.googleapis.com` without specifying a project parameter.
  4. D
    Grant the engineer the Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`) on `analytics-prod-12`, and execute `gcloud quotas requests create --service=run.googleapis.com --project=analytics-prod-12`.

Cevap

Grant the engineer the Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`) on `analytics-prod-12`, and execute `gcloud services enable run.googleapis.com --project=analytics-prod-12`.
To enable Google Cloud service APIs in a project while following security best practices, you must assign the predefined Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`), which grants permissions to enable and disable services without granting full project ownership. The correct gcloud CLI command syntax to enable an API for a specific project is `gcloud services enable SERVICE_NAME --project=PROJECT_ID`.

Adım Adım Çözüm

1
Identify the required IAM permissions for managing GCP Service APIs.
The Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`) provides the permissions necessary to enable, disable, and inspect APIs in a project without granting excessive administrative rights.
Adhering to the principle of least privilege requires avoiding broad primitive roles like Owner or Editor when specific predefined roles exist.
2
Determine the correct Cloud SDK (`gcloud`) command syntax for enabling an API.
The syntax is `gcloud services enable SERVICE_NAME --project=PROJECT_ID`.
Specifying the `--project` flag guarantees that the API is enabled in the intended project (`analytics-prod-12`).

Anahtar Kavram

Enabling Cloud Service APIs using least-privilege IAM roles and the gcloud CLI
Bu soruyu puanla

Konular

Enabling and Managing Cloud Service APIs

Bu konudan daha fazla soru