Google Professional Cloud DevOps Engineer Question 181
Single answerGoogle Cloud PlatformYour organization uses Google Cloud and has recently implemented a new folder hierarchy to manage projects for different teams. You are tasked with setting up access controls. The organization’s security policy mandates that permissions should be inherited wherever possible and that teams should only have access to the projects they manage. How should you configure IAM permissions to meet this requirement?
- A
Apply IAM roles at the organization level to cover all projects and folders.
- B
Apply IAM roles at the folder level for each team, ensuring access is inherited by the projects within the folder.
- C
Apply IAM roles directly to each individual project to restrict access on a per-project basis.
- D
Use Service Accounts instead of IAM roles to handle access control for projects.
Show answer and explanation
Correct answer: B
Explanation
The correct approach is to apply IAM roles at the folder level. By doing so, permissions are inherited by all projects within the folder, simplifying access management while adhering to the security policy. This ensures that each team only has access to the projects they manage, without granting excessive permissions or requiring manual configuration for each project.
- A. Incorrect.
Applying IAM roles at the organization level grants unnecessary access to all projects and folders, which violates the security policy of restricting access to only the projects teams manage.
- B. Correct.
Applying IAM roles at the folder level ensures that access is inherited by all projects within a folder, aligning with the requirement to use inheritance where possible and restricting access to only the relevant team’s projects.
- C. Incorrect.
Applying IAM roles directly to each project is not scalable and does not leverage inheritance, making it harder to manage permissions efficiently across multiple projects.
- D. Incorrect.
Service Accounts are typically used for application or service-based access, not for managing human user access to projects. This is not the correct approach to configure team-level access controls.