Google Professional Cloud Security Engineer Question 110
Select 2Google Cloud PlatformYour organization uses Google Cloud to host a critical application. The application requires granular access controls to ensure that team members only have the permissions necessary for their roles. You have been tasked with implementing authorization controls while adhering to the principle of least privilege. Which steps should you take to achieve this? (Choose two.)
- A
Assign predefined IAM roles like 'Owner' to all team members for flexibility in managing resources.
- B
Create custom IAM roles with only the permissions required for specific tasks.
- C
Grant permissions at the organization level to simplify management.
- D
Use resource-level IAM policies to assign permissions as narrowly as possible.
- E
Enable multi-factor authentication (MFA) for all user accounts.
Show answer and explanation
Correct answers: B, D
Explanation
To implement authorization controls effectively while adhering to the principle of least privilege, you should create custom IAM roles with only the necessary permissions and apply resource-level IAM policies for precise access control. These practices minimize the risk of over-permissioning and ensure that users have only the access they need to perform their tasks.
- A. Incorrect.
Assigning predefined IAM roles like 'Owner' to all team members violates the principle of least privilege, as it grants excessively broad permissions that are unnecessary for most tasks.
- B. Correct.
Creating custom IAM roles allows you to define specific permissions tailored to the tasks users need to perform, aligning with the principle of least privilege.
- C. Incorrect.
Granting permissions at the organization level is too broad and can lead to over-permissioning. It's better to apply permissions at the resource level when possible.
- D. Correct.
Using resource-level IAM policies helps to assign permissions narrowly, ensuring that users only have access to the resources they need.
- E. Incorrect.
While enabling MFA is important for securing accounts, it is not directly related to implementing authorization controls or the principle of least privilege.