Examkin

Soru

Zorluk: ZorManaging IAM Roles and Resource Access Permissions

An enterprise infrastructure team needs to grant an automated backup service account the permission to create, delete, and manage Compute Engine persistent disk snapshots within a specific project named `prod-data-01`. To adhere to security policy, the service account must not have permissions to modify compute instances, view instance metadata, or access network configurations. Following Google Cloud recommended security best practices, which IAM role assignment should you configure for the service account?

  1. Grant Compute Storage Admin (roles/compute.storageAdmin) on the project prod-data-01Cevap
  2. B
    Grant Editor (roles/editor) on the project prod-data-01
  3. C
    Grant Compute Admin (roles/compute.admin) at the parent organization level
  4. D
    Grant Billing Account User (roles/billing.user) on the project prod-data-01

Cevap

Grant the predefined Compute Storage Admin role (roles/compute.storageAdmin) resource-scoped at the project level.
The Compute Storage Admin (roles/compute.storageAdmin) role grants full control over persistent disks, images, and snapshots without permitting actions on virtual machine instances, networks, or other GCP services. Applying this at project scope satisfies all functional requirements while strictly maintaining least privilege.

Adım Adım Çözüm

1
Analyze the operational requirements
The target identity requires managing disk snapshots while lacking permissions for instance management and networking.
Security guidelines mandate adhering to the principle of least privilege.
2
Evaluate role granularity and scope
Primitive roles like Editor or high-level broad roles like Compute Admin grant excess permissions. Compute Storage Admin narrowly restricts privileges to disks, images, and snapshots.
Predefined roles tailored to specific resource subsets avoid over-privileging.
3
Select resource hierarchy level for policy binding
Bind the role at the target project level (`prod-data-01`).
Granting permissions at the organization level causes unwanted inheritance across all subordinate projects.

Anahtar Kavram

Applying Least Privilege via Predefined IAM Roles at Project Scope
Bu soruyu puanla

Konular

Managing IAM Roles and Resource Access Permissions

Bu konudan daha fazla soru