Google Professional Cloud Security Engineer Question 114
Single answerGoogle Cloud PlatformYour organization uses Google Cloud to host its applications and data. To comply with security best practices, you need to enforce separation of duties between the development team and the operations team. The development team should have permissions to deploy and manage applications, but they must not have access to manage IAM policies. The operations team should manage IAM policies but not modify application configurations. Which approach should you take to implement this?
- A
Assign the 'Owner' role to the development team and the 'Editor' role to the operations team.
- B
Create custom IAM roles for both teams: one role with permissions for application deployment and management for the development team, and another role with permissions for IAM policy management for the operations team.
- C
Assign the 'Editor' role to the development team and the 'IAM Admin' role to the operations team.
- D
Use the 'Project Viewer' role for both teams and grant additional permissions only when necessary using custom roles.
Show answer and explanation
Correct answer: B
Explanation
To enforce separation of duties effectively, you should use custom IAM roles designed specifically for each team's responsibilities. This allows you to grant the minimum required permissions for each team, ensuring that the development team cannot manage IAM policies and the operations team cannot modify application configurations. Predefined roles like 'Owner', 'Editor', and 'IAM Admin' are typically too broad for this use case and may lead to privilege overreach.
- A. Incorrect.
The 'Owner' and 'Editor' roles are broad predefined roles that grant excessive permissions, violating the principle of least privilege. This would not enforce separation of duties effectively.
- B. Correct.
Creating custom IAM roles tailored to the specific responsibilities of each team ensures they only have the permissions they need, adhering to the principle of least privilege and ensuring separation of duties.
- C. Incorrect.
The 'Editor' role grants permissions to manage resources, including IAM policies, which conflicts with the requirement to restrict the development team from accessing IAM management. Similarly, the 'IAM Admin' role grants permissions beyond what is necessary for the operations team.
- D. Incorrect.
The 'Project Viewer' role is too restrictive for both teams, as it only provides read-only access and does not allow for application management or IAM administration.