Google Associate Cloud Engineer Question 348
Select 3Google Cloud PlatformYou are configuring a new application to run on Google Cloud Platform and need to ensure it can interact with Cloud Storage and BigQuery securely. Which steps should you take to create a service account that grants the necessary permissions to the application?
- A
Create a new service account under IAM & Admin and assign it the Storage Admin role.
- B
Create a new service account under IAM & Admin and assign it the BigQuery Data Viewer role.
- C
Use an existing service account and manually edit its permissions to add Storage Object Viewer role.
- D
Create a new service account and assign it both the Storage Admin and BigQuery Admin roles.
- E
Enable the Identity and Access Management (IAM) API before creating the service account.
Show answer and explanation
Correct answers: A, B, E
Explanation
When setting up a service account for a new application on Google Cloud Platform, it is important to assign roles that provide the necessary permissions without granting more access than needed, following the principle of least privilege. Creating a new service account with specific roles for Cloud Storage and BigQuery ensures security and proper access control. Additionally, enabling the IAM API is a prerequisite for managing service accounts programmatically.
- A. Correct.
This option is correct because creating a new service account and assigning it the Storage Admin role allows the application to manage Cloud Storage resources.
- B. Correct.
This option is correct because creating a new service account and assigning it the BigQuery Data Viewer role enables the application to view BigQuery datasets.
- C. Incorrect.
While you can use an existing service account, manually editing permissions is prone to errors and not recommended when setting up a new application.
- D. Incorrect.
Assigning the BigQuery Admin role grants more permissions than necessary, which goes against the principle of least privilege.
- E. Correct.
Enabling the IAM API is a necessary step before creating or managing any service accounts through the API.