Examkin

Soru

Zorluk: OrtaIdentity and Access Management (IAM) Roles and Resource Hierarchy

An enterprise is setting up access control for an automated auditing service account that must inspect resource configurations and IAM policies across all current and future projects inside a department folder. The service account needs to read security configurations without being granted access to view sensitive underlying data inside Cloud Storage buckets or modify any cloud resources. Which strategy fulfills these requirements while adhering to Google Cloud best practices and the principle of least privilege?

  1. Grant the Security Reviewer role (roles/securityReviewer) to the service account at the department folder level.Cevap
  2. B
    Grant the Viewer primitive role (roles/viewer) to the service account at the department folder level.
  3. C
    Grant the Service Account Admin role (roles/iam.serviceAccountAdmin) to the service account at the organization level.
  4. D
    Grant the Storage Object Viewer role (roles/storage.objectViewer) to the service account at the department folder level, relying solely on IAM to restrict exfiltration.

Cevap

Grant the Security Reviewer role (roles/securityReviewer) to the service account at the department folder level.
Granting the Security Reviewer role (`roles/securityReviewer`) at the department folder level ensures that the automated auditing service account inherits read-only permissions for security configurations and IAM policies across all child projects. It strictly avoids granting access to data payloads inside Cloud Storage buckets, perfectly satisfying least privilege and automated resource hierarchy inheritance.

Adım Adım Çözüm

1
Identify the required level of access and hierarchy scope.
The auditing service account requires read access to security and IAM metadata for all projects in a department folder, inherited by future projects, without data access.
Applying the role at the folder level enables IAM permission inheritance for all child projects automatically.
2
Select the predefined role matching least privilege for security auditing.
The `roles/securityReviewer` role provides read-only access to security-related settings and IAM policies without exposing payload data.
Primitive roles like Viewer grant excessive read access to actual data objects, whereas Security Reviewer is specifically tailored for security audit compliance.

Anahtar Kavram

Resource Hierarchy IAM Inheritance and Predefined Security Roles
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Identity and Access Management (IAM) Roles and Resource Hierarchy