Examkin

Soru

Zorluk: Çok zorIdentity and Access Management (IAM) Roles and Resource Hierarchy

A healthcare enterprise uses a Google Cloud resource hierarchy consisting of an Organization node, Department Folders, and nested Environment Folders ('Production' and 'Development'). A third-party security compliance system requires read-only access to inspect resource configurations, organizational security settings, and IAM access control lists across all Production projects, but must not be permitted to read underlying customer payload data in Cloud Storage or BigQuery. Which IAM role assignment strategy follows Google-recommended best practices for least privilege and operational efficiency?

  1. Grant the predefined Security Reviewer role (roles/iam.securityReviewer) to the compliance system service account on the Production Environment Folder.Cevap
  2. B
    Grant the primitive Viewer role (roles/viewer) to the compliance system service account on each individual Project node inside the Production Environment Folder.
  3. C
    Grant the Service Account Admin role (roles/iam.serviceAccountAdmin) to the compliance system service account at the Organization node level.
  4. D
    Grant the Storage Object Viewer role (roles/storage.objectViewer) and BigQuery Data Viewer role (roles/bigquery.dataViewer) at the Production Environment Folder level, relying on IAM policy restrictions alone to prevent data exfiltration.

Cevap

Grant the predefined Security Reviewer role (roles/iam.securityReviewer) to the compliance system service account on the Production Environment Folder.
The predefined Security Reviewer role (roles/iam.securityReviewer) is specifically tailored for security auditing and compliance tools. It permits viewing security configurations, IAM policies, and asset metadata across resources. By assigning this role at the Production Environment Folder level, IAM policy inheritance automatically applies the permission to all existing and future projects beneath that folder, avoiding project-level management overhead and preventing exposure to raw stored data.

Adım Adım Çözüm

1
Analyze access scope and least-privilege role requirements
The scenario requires inspecting security configurations, organizational IAM policies, and metadata across all production environments without reading actual underlying data payloads.
Granting data-level read roles or primitive roles exposes sensitive customer data stored in Cloud Storage or BigQuery.
2
Evaluate GCP predefined roles vs primitive/administrative roles
The predefined role 'Security Reviewer' (roles/iam.securityReviewer) provides specialized access to security configurations and IAM policies across GCP resources without providing data-payload read rights.
Using predefined security-focused roles ensures minimal required permissions while maintaining operational separation.
3
Leverage Resource Hierarchy for policy inheritance
Assigning the Security Reviewer role at the 'Production' Folder level automatically inherits down to all present and future child projects under that folder.
Inheritance reduces management overhead and eliminates the need to configure permissions on individual projects manually.

Anahtar Kavram

Identity and Access Management (IAM) Roles and Resource Hierarchy Inheritance
Bu soruyu puanla

Konular

Identity and Access Management (IAM) Roles and Resource Hierarchy