Google Professional Cloud Network Engineer Question 38
Select 2Google Cloud PlatformYou are designing IAM roles for a Shared VPC environment in Google Cloud. The Shared VPC host project is managed by your networking team, and the service projects are managed by individual application teams. Each application team requires the ability to create and manage their Compute Engine instances in their service project, but they should not be able to modify the Shared VPC network configuration. Which IAM roles should you assign to the application teams to meet these requirements?
- A
Compute Network User role on the Shared VPC host project
- B
Compute Viewer role on the Shared VPC host project
- C
Compute Admin role on the service project
- D
Network Admin role on the Shared VPC host project
- E
Compute Network Admin role on the Shared VPC host project
Show answer and explanation
Correct answers: A, C
Explanation
In a Shared VPC environment, the Compute Network User role on the Shared VPC host project is sufficient to allow application teams to use existing subnets and firewall rules for their Compute Engine instances. The Compute Admin role on the service project enables them to manage the Compute Engine resources within their project. Other roles, such as Network Admin and Compute Network Admin, provide excessive permissions that are not required for this use case and could pose security risks.
- A. Correct.
Correct: The Compute Network User role on the Shared VPC host project grants the necessary permissions to use existing Shared VPC subnets and firewalls for Compute Engine instances in the service project, without permissions to modify network configurations.
- B. Incorrect.
Incorrect: The Compute Viewer role only provides read-only access to network resources and does not allow creating or managing Compute Engine instances.
- C. Correct.
Correct: The Compute Admin role on the service project allows users to create and manage Compute Engine resources such as instances, disks, and images, which is required for application teams to manage their workloads.
- D. Incorrect.
Incorrect: The Network Admin role on the Shared VPC host project provides full control over the network configuration, which is overly permissive and not required for the application teams.
- E. Incorrect.
Incorrect: The Compute Network Admin role on the Shared VPC host project allows full control over network resources in the Shared VPC, which exceeds the required permissions and could allow modifying network configurations.