Google Professional Cloud Security Engineer Question 111
Select 2Google Cloud PlatformYou are tasked with securing access to a sensitive Google Cloud project used by the finance team. The project contains critical data stored in BigQuery and Cloud Storage. To implement authorization controls, you must ensure that only members of the finance team can access these resources, while minimizing administrative overhead and ensuring compliance with the principle of least privilege. Which steps should you take?
- A
Create a custom IAM role with the required permissions for BigQuery and Cloud Storage, and assign it directly to individual finance team members.
- B
Assign the predefined 'BigQuery Data Viewer' and 'Storage Object Viewer' roles to a Google Group containing all finance team members.
- C
Use VPC Service Controls to restrict access to BigQuery and Cloud Storage resources to the finance team.
- D
Create a custom IAM role for finance team members, assign it to a Google Group, and add the group to the project's IAM policy.
- E
Assign the Owner role at the project level to a Google Group containing all finance team members.
Show answer and explanation
Correct answers: B, D
Explanation
To manage and implement authorization controls effectively, you should use IAM roles and Google Groups to simplify access management while adhering to the principle of least privilege. Predefined roles like 'BigQuery Data Viewer' and 'Storage Object Viewer' can be leveraged to avoid creating custom roles unnecessarily. Assigning roles to a Google Group containing the finance team ensures scalability and easy membership management. Assigning overly permissive roles, such as the Owner role, or relying solely on VPC Service Controls does not align with best practices for managing authorization controls.
- A. Incorrect.
This option creates a custom IAM role, which can increase administrative overhead and is unnecessary since predefined roles already exist for BigQuery and Cloud Storage. Assigning roles directly to individual users also does not scale well and violates the principle of least privilege.
- B. Correct.
This is a valid approach. Using predefined roles like 'BigQuery Data Viewer' and 'Storage Object Viewer' ensures minimal permissions are granted. Assigning these roles to a Google Group simplifies management and adheres to the principle of least privilege.
- C. Incorrect.
While VPC Service Controls can add an additional layer of security, they are not a substitute for proper IAM authorization controls. They are used to define service perimeters rather than manage user access.
- D. Correct.
This is a valid approach. Creating a custom IAM role tailored to the finance team's needs ensures compliance with least privilege. Assigning the role to a Google Group simplifies user management and reduces administrative overhead.
- E. Incorrect.
Assigning the Owner role at the project level grants excessive permissions and violates the principle of least privilege. This approach is not recommended for securing sensitive resources.