Examkin

Soru

Zorluk: Çok zorIdentity and Access Management (IAM) Roles and Resource Hierarchy

A bio-informatics platform processes sensitive clinical datasets across multiple Google Cloud projects contained within a single dedicated folder named Genomics-Prod. To ensure compliance, an external audit identity requires access to review all IAM policy bindings and resource configurations across all projects within Genomics-Prod without being able to read underlying storage object data or modify permissions. Additionally, development teams need permission to attach specific workload service accounts to Compute Engine instances without being allowed to modify service account permissions or create new service accounts. Which IAM role assignment strategy satisfies these requirements while strictly adhering to the principle of least privilege?

  1. Grant the roles/iam.securityReviewer role to the audit identity at the Genomics-Prod folder level, and grant developers the roles/iam.serviceAccountUser role on the specific workload service accounts.Cevap
  2. B
    Grant the primitive roles/viewer role to the audit identity at the Genomics-Prod folder level, and grant developers the roles/iam.serviceAccountUser role at the Genomics-Prod folder level.
  3. C
    Grant the roles/iam.securityReviewer role to the audit identity at the Genomics-Prod folder level, and grant developers the roles/iam.serviceAccountAdmin role across all projects in the Genomics-Prod folder.
  4. D
    Grant roles/storage.objectViewer and roles/iam.securityReviewer to the audit identity at the Genomics-Prod folder level, relying exclusively on IAM restrictions to prevent object exfiltration to external environments.

Cevap

Grant the roles/iam.securityReviewer role to the audit identity at the Genomics-Prod folder level, and grant developers the roles/iam.serviceAccountUser role on the specific workload service accounts.
Assigning roles/iam.securityReviewer at the Genomics-Prod folder level ensures inherited compliance visibility across all sub-projects without providing access to read bucket payload data. Granting roles/iam.serviceAccountUser specifically on the target workload service accounts enforces least privilege, allowing developers to attach approved service accounts to instances without elevating their administrative control over service accounts.

Adım Adım Çözüm

1
Evaluate the auditing requirement across the resource hierarchy.
Assigning roles/iam.securityReviewer at the folder level allows reading IAM policies and asset metadata for all descendant projects without granting read access to underlying data objects.
Folder-level IAM bindings inherit downwards, satisfying the requirement to cover all projects under Genomics-Prod with minimum operational overhead.
2
Evaluate developer access requirements for service account utilization.
Granting roles/iam.serviceAccountUser at the individual service account resource level allows developers to attach the service account to instances.
Scoping roles/iam.serviceAccountUser to individual service accounts prevents developers from impersonating unapproved service accounts or gaining administrative privileges over IAM policies.

Anahtar Kavram

Resource hierarchy inheritance and predefined fine-grained IAM roles for security auditing and service account usage
Bu soruyu puanla

Konular

Identity and Access Management (IAM) Roles and Resource Hierarchy