Examkin

Soru

Zorluk: OrtaIdentity and Access Management (IAM) Roles and Resource Hierarchy

A Cloud Architect is auditing permission inheritance for a team accessing data inside Google Cloud. Arrange the levels of the Google Cloud resource hierarchy in order from the highest scope of IAM policy inheritance (broadest level) to the most granular scope of IAM policy inheritance (lowest level).

  1. 1Organization Node Level
  2. 2Folder Level
  3. 3Project Level
  4. 4Resource Level

Cevap

The correct evaluation order from broadest scope of inheritance to most granular scope is Organization Node Level, followed by Folder Level, Project Level, and finally Resource Level.
Google Cloud IAM follows a strict top-down resource hierarchy inheritance model: Organization -> Folder -> Project -> Resource. Permissions granted at a parent level automatically inherit down to all descendant nodes and cannot be restricted by lower-level policies.

Adım Adım Çözüm

1
Identify the root container of the GCP resource hierarchy.
The Organization node is the root container.
IAM bindings at the Organization level apply globally across all sub-nodes.
2
Identify intermediate grouping structures beneath the Organization.
Folders act as intermediate grouping mechanisms.
Folders allow administrative isolation and IAM policy inheritance across groups of projects.
3
Identify the project container level.
Projects are the primary organizational units for resources.
IAM roles granted at the project level inherit down to all service instances inside that project.
4
Identify individual service resource nodes.
Individual resources form the leaves of the hierarchy tree.
Resource-level IAM policies (where supported, like Cloud Storage buckets) apply directly to that specific asset.

Anahtar Kavram

IAM policy inheritance down the Google Cloud Resource Hierarchy
Bu soruyu puanla

Konular

Identity and Access Management (IAM) Roles and Resource Hierarchy