Examkin

Soru

Zorluk: KolayManaging IAM Roles and Permissions

Your team needs to grant a newly hired developer access to manage Compute Engine virtual machine instances (create, start, stop, and delete) within a specific Google Cloud project. The developer must not be granted permissions to modify project firewall rules, VPC networks, or IAM policies. Following the principle of least privilege, which IAM role should you grant to the developer at the project level?

  1. Compute Instance Admin (v1) (roles/compute.instanceAdmin.v1)Cevap
  2. B
    Editor (roles/editor)
  3. C
    Compute Instance Admin (v1) (roles/compute.instanceAdmin.v1) bound at the Organization level
  4. D
    Owner (roles/owner)

Cevap

Grant the predefined Compute Instance Admin (v1) role (roles/compute.instanceAdmin.v1) at the project level.
The Compute Instance Admin (v1) role (roles/compute.instanceAdmin.v1) grants full control over Compute Engine instances while omitting permissions for networking, security, and other GCP services, satisfying the principle of least privilege.

Adım Adım Çözüm

1
Identify the required operational capabilities.
The user needs to manage Compute Engine instances (create, start, stop, delete).
Determining exact job requirements allows matching with the most granular IAM role available.
2
Select a role aligned with the principle of least privilege.
The Compute Instance Admin (v1) role provides full instance management without granting network administration or broad project permissions.
Predefined service roles target specific resource management needs, whereas primitive roles (Editor, Owner) grant overly broad permissions.
3
Identify the correct resource hierarchy scope.
Apply the role binding at the specific project level.
Permissions bound at higher levels (Folder or Organization) inherit downward to all child projects.

Anahtar Kavram

Least Privilege and IAM Predefined Roles
Tahmini Süre:1m 0s
Bu soruyu puanla

Konular

Managing IAM Roles and Permissions

Bu konudan daha fazla soru