A security administration team needs to grant a group of compliance auditors read-only access to inspect resource configurations and review IAM policies across all projects grouped under a specific department folder in Google Cloud. Which TWO role assignments at the folder level satisfy these requirements while adhering to the principle of least privilege?
- Assign the Security Reviewer role (roles/iam.securityReviewer) to the auditor group at the folder level.Cevap
- Assign the Folder Viewer role (roles/resourcemanager.folderViewer) to the auditor group at the folder level.Cevap
- CAssign the primitive Owner role (roles/owner) to the auditor group at the folder level.
- DAssign the Service Account User role (roles/iam.serviceAccountUser) to the auditor group at the folder level.
Cevap
Assign the Security Reviewer role (roles/iam.securityReviewer) and the Folder Viewer role (roles/resourcemanager.folderViewer) to the auditor group at the folder level.
Granting the Security Reviewer role allows auditors to examine IAM bindings and security posture, while the Folder Viewer role enables them to view the resource hierarchy structure under the specified folder. Both roles follow the principle of least privilege by providing targeted read-only capabilities.
Adım Adım Çözüm
Anahtar Kavram
IAM Policy Inheritance and Predefined Roles for Compliance Auditing
Tahmini Süre:1m 0s