Google Professional Cloud DevOps Engineer Question 9
Select 2Google Cloud PlatformYour company has multiple GCP projects under a single organization. The security team has mandated that no user should have the 'Owner' role at the organization level, and sensitive resources must not be accessible to external identities. As a Cloud DevOps Engineer, how should you enforce these requirements?
- A
Set an organization policy to restrict the use of the 'roles/owner' IAM role at the organization level.
- B
Create a custom IAM role with the same permissions as 'roles/owner' and assign it to select users at the organization level.
- C
Enable the 'Domain Restricted Sharing' organization policy to prevent external identities from accessing sensitive resources.
- D
Manually audit all IAM policies in each project and remove 'roles/owner' from any user assigned at the organization level.
- E
Use the Google Cloud Policy Troubleshooter to ensure that the 'roles/owner' role is only used at the project level.
Show answer and explanation
Correct answers: A, C
Explanation
To enforce the security mandates, you must leverage organization-level policies in Google Cloud. Restricting the 'roles/owner' IAM role at the organization level prevents excessive permissions, while enabling the 'Domain Restricted Sharing' policy ensures that sensitive resources are not accessed by external identities. These measures are scalable and align with best practices for managing IAM roles and organization-level security in GCP.
- A. Correct.
This is correct. Setting an organization policy to restrict the use of the 'roles/owner' IAM role helps enforce the security team's requirement to prevent users from having the 'Owner' role at the organization level.
- B. Incorrect.
This is incorrect. Creating a custom role with the same permissions as 'roles/owner' contradicts the security mandate and does not solve the issue of excessive permissions.
- C. Correct.
This is correct. Enabling the 'Domain Restricted Sharing' policy ensures that sensitive resources are not shared with external identities, addressing the requirement to secure resources from external access.
- D. Incorrect.
This is incorrect. While manually auditing IAM policies can help identify violations, it is not an automated or scalable solution for enforcing organization-wide security policies.
- E. Incorrect.
This is incorrect. The Policy Troubleshooter is a tool for investigating and troubleshooting access issues, not for enforcing organization-level IAM policies.