Examkin

Soru

Zorluk: KolayManaging IAM Roles and Resource Access Permissions

A system administrator needs permissions to fully manage Cloud SQL database instances and view Pub/Sub topics within a single Google Cloud project. Following Google Cloud security best practices for least privilege without using primitive roles, which TWO predefined IAM roles should be assigned to the administrator?

  1. Cloud SQL Admin (roles/cloudsql.admin)Cevap
  2. Pub/Sub Viewer (roles/pubsub.viewer)Cevap
  3. C
    Editor (roles/editor)
  4. D
    Pub/Sub Admin (roles/pubsub.admin)

Cevap

The correct predefined roles are Cloud SQL Admin (roles/cloudsql.admin) to manage Cloud SQL instances and Pub/Sub Viewer (roles/pubsub.viewer) to view Pub/Sub topics.
Cloud SQL Admin allows full management of Cloud SQL instances, while Pub/Sub Viewer allows viewing Pub/Sub topics and subscriptions without granting modification rights. Together, these predefined roles fulfill the requirements under the principle of least privilege.

Adım Adım Çözüm

1
Identify the required permissions for managing Cloud SQL instances.
The Cloud SQL Admin role provides full management permissions for Cloud SQL without granting permissions to unrelated services.
Predefined roles are preferred over primitive roles to enforce the principle of least privilege.
2
Identify the required permissions for viewing Pub/Sub messaging topics.
The Pub/Sub Viewer role grants permission to view topics and subscriptions without administrative or modification privileges.
Read-only access requests should be mapped to Viewer predefined roles rather than Admin roles.

Anahtar Kavram

Applying the principle of least privilege using predefined IAM roles instead of primitive or overly permissive roles.
Bu soruyu puanla

Konular

Managing IAM Roles and Resource Access Permissions

Bu konudan daha fazla soru