Google Professional Cloud Security Engineer Question 117
Select 2Google Cloud PlatformYour organization is using Google Cloud and wants to implement the principle of least privilege to manage access effectively. The security team has decided to split administrative responsibilities between two teams: Team A manages user accounts and groups, while Team B manages billing and project-level resources. Which IAM roles should you assign to achieve this separation of duties while adhering to the principle of least privilege?
- A
Roles/iam.securityAdmin for Team A and roles/billing.admin for Team B
- B
Roles/iam.roleAdmin for Team A and roles/resourcemanager.projectIamAdmin for Team B
- C
Roles/iam.userAdmin for Team A and roles/billing.admin for Team B
- D
Roles/iam.viewer for Team A and roles/owner for Team B
- E
Roles/iam.userAdmin for Team A and roles/resourcemanager.projectIamAdmin for Team B
Show answer and explanation
Correct answers: C, E
Explanation
To adhere to the principle of least privilege and ensure proper separation of duties, Team A should be assigned roles/iam.userAdmin to manage user accounts and groups, as it provides sufficient permissions without over-provisioning. Team B should be assigned roles/billing.admin to manage billing responsibilities OR roles/resourcemanager.projectIamAdmin if their scope includes managing project-level IAM policies. These roles ensure that each team has the correct level of access required for their specific responsibilities while minimizing risks associated with excessive permissions.
- A. Incorrect.
Roles/iam.securityAdmin grants broad permissions to manage IAM policies and roles, which is excessive for Team A's task of managing user accounts. Similarly, roles/billing.admin is appropriate for billing but is irrelevant to Team A's scope.
- B. Incorrect.
Roles/iam.roleAdmin for Team A allows the creation and modification of custom roles, which is unrelated to managing user accounts. Additionally, roles/resourcemanager.projectIamAdmin for Team B grants permissions beyond billing and project-level resource management, violating the principle of least privilege.
- C. Correct.
Roles/iam.userAdmin is specifically designed for managing user accounts and groups, making it a perfect fit for Team A. Roles/billing.admin allows Team B to manage billing, aligning perfectly with their responsibility.
- D. Incorrect.
Roles/iam.viewer only provides read-only access, which does not allow Team A to manage user accounts. Assigning the roles/owner role to Team B grants full control over resources, which violates the principle of least privilege.
- E. Correct.
Roles/iam.userAdmin for Team A provides the right level of access for managing user accounts, and roles/resourcemanager.projectIamAdmin allows Team B to manage project-level IAM policies, aligning with the separation of duties.