Examkin

Soru

Zorluk: ZorManaging Cloud Projects and Resource Hierarchy

An infrastructure administrator must configure an automated CI/CD service account to provision new workload projects inside a designated parent folder named `Data-Ingestion-Platform` and link those projects to the enterprise billing account `012345-6789AB-CDEF01`. Which requirements and resource hierarchy behaviors apply to this setup according to Google Cloud best practices? (Select TWO choices.)

  1. The service account must be granted the Project Creator role (roles/resourcemanager.projectCreator) on the Data-Ingestion-Platform folder and the Billing Account User role (roles/billing.user) on the target billing account.Cevap
  2. IAM roles granted on the Data-Ingestion-Platform folder are additively inherited by all child projects and cannot be overridden to restrict inherited access at the project level.Cevap
  3. C
    The service account must be granted the Owner primitive role (roles/owner) at the Organization node level to enable project creation and billing account binding across folders.
  4. D
    Linking a project to a billing account requires granting the Billing Account Admin role (roles/billing.admin) directly on the newly created project instance.
  5. E
    An administrator can explicitly revoke a folder-level inherited role on a specific child project by configuring a project-level IAM policy binding deletion.

Cevap

The service account requires the Project Creator role on the target folder and the Billing Account User role on the billing account, and IAM permissions granted at the parent folder level are additively inherited by child projects without possibility of child-level revocation.
To create a project within a specific folder and link it to a billing account, the acting principal needs `roles/resourcemanager.projectCreator` on the parent folder and `roles/billing.user` on the billing account. Furthermore, Google Cloud IAM policy inheritance is additive: permissions granted on parent folders flow down to child projects and cannot be revoked at the child level.

Adım Adım Çözüm

1
Determine the required IAM roles for project creation and billing account linking under least privilege.
Creating projects inside a specific folder requires `roles/resourcemanager.projectCreator` on that folder. Linking projects to a billing account requires `roles/billing.user` on the billing account itself.
Permissions must be scoped precisely to the necessary resources and predefined roles rather than using broad primitive roles at the Organization level.
2
Analyze how IAM inheritance operates within the Google Cloud resource hierarchy (Organization > Folder > Project > Resource).
Policies inherited from parent folders apply to all descendant projects. Permissions are additive and cannot be denied or revoked at lower nodes.
Google Cloud IAM follows a strict additive union model where effective permissions on a resource are the union of permissions granted at the resource itself and all its parent nodes.

Anahtar Kavram

Resource Hierarchy IAM Inheritance & Project Provisioning Roles
Bu soruyu puanla

Konular

Managing Cloud Projects and Resource Hierarchy

Bu konudan daha fazla soru