Examkin

Soru

Zorluk: OrtaManaging Cloud Projects and Resource Hierarchy

An enterprise cloud operations team manages a Google Cloud resource hierarchy containing an Organization node, top-level environment Folders, and team-specific sub-folders. A security engineer needs to grant a lead analyst the ability to manage compute resources across all current and future projects located inside the 'Analytics-Dev' sub-folder, while following Google-recommended security practices and avoiding unnecessary operational maintenance. What should the security engineer do?

  1. Grant the predefined Compute Admin role to the lead analyst at the 'Analytics-Dev' sub-folder level.Cevap
  2. B
    Grant the predefined Compute Admin role to the lead analyst individually on each current project inside the 'Analytics-Dev' sub-folder.
  3. C
    Grant the primitive Editor role to the lead analyst at the Organization root level.
  4. D
    Configure an Organization Policy at the 'Analytics-Dev' sub-folder level specifying the lead analyst user identity as an allowed admin principal.

Cevap

Grant the predefined Compute Admin role to the lead analyst at the 'Analytics-Dev' sub-folder level.
Granting the predefined Compute Admin role at the folder level leverages Google Cloud's IAM resource hierarchy policy inheritance. Permissions applied at a parent folder automatically flow down to all current and future child projects residing within that folder. Furthermore, using a predefined role ensures compliance with the principle of least privilege compared to broad primitive roles.

Adım Adım Çözüm

1
Analyze the scope requirement
Access must apply to all existing and future projects within the 'Analytics-Dev' sub-folder.
Permissions granted at parent nodes in the GCP resource hierarchy (Organization > Folder > Project > Resource) are transitively inherited by all child resources.
2
Select the appropriate IAM role type
Choose the predefined Compute Admin role over broad primitive roles like Editor or Owner.
Predefined roles adhere to the principle of least privilege by scoping permissions specifically to Compute Engine resources.
3
Identify the target resource binding location
Bind the role at the 'Analytics-Dev' sub-folder resource level.
Binding at the folder level ensures automatic policy inheritance for both existing and newly created projects under that folder without ongoing manual maintenance.

Anahtar Kavram

Resource Hierarchy IAM Inheritance & Predefined Roles
Bu soruyu puanla

Konular

Managing Cloud Projects and Resource Hierarchy

Bu konudan daha fazla soru