Google Professional Cloud Security Engineer Question 127
Select 2Google Cloud PlatformYour organization has a Google Cloud project where access to a sensitive dataset in BigQuery must be tightly controlled. You need to allow members of the Data Analysts group to access the dataset only during business hours (9 AM to 5 PM) on weekdays. Additionally, you want to ensure that no one, not even project owners, can delete the dataset. What combination of IAM configurations should you apply to meet these requirements?
- A
Create an IAM policy binding for the Data Analysts group with the 'roles/bigquery.dataViewer' role and apply an IAM condition to restrict access to business hours on weekdays.
- B
Create an IAM policy binding for the Data Analysts group with the 'roles/bigquery.dataEditor' role and apply an IAM condition to restrict access to business hours on weekdays.
- C
Apply an IAM deny policy to the dataset to explicitly deny the 'bigquery.tables.delete' permission for all identities.
- D
Apply an IAM deny policy to the dataset to explicitly deny the 'bigquery.datasets.delete' permission for all identities.
- E
Create an IAM condition that allows access to the dataset only from specific IP ranges used by the organization.
Show answer and explanation
Correct answers: A, D
Explanation
To meet the scenario's requirements, you need to control access to the dataset using IAM conditions and prevent deletion using an IAM deny policy. Assigning the 'roles/bigquery.dataViewer' role with a condition ensures that the Data Analysts group can access the dataset during business hours on weekdays. Applying a deny policy to block the 'bigquery.datasets.delete' permission ensures that no one can delete the dataset, fulfilling the second requirement. Other options either grant excessive permissions, do not fully meet the requirements, or address unrelated concerns.
- A. Correct.
This option is correct because it assigns the 'roles/bigquery.dataViewer' role to the Data Analysts group and uses an IAM condition to restrict access to specific timeframes, which aligns with the requirement to allow access only during business hours on weekdays.
- B. Incorrect.
This option is incorrect because the 'roles/bigquery.dataEditor' role grants the ability to modify the dataset, which exceeds the requirement to only view the data.
- C. Incorrect.
This option is incorrect because it focuses on denying the 'bigquery.tables.delete' permission, but the scenario requires ensuring the dataset itself cannot be deleted. This option does not fully address the requirement.
- D. Correct.
This option is correct because applying an IAM deny policy to explicitly deny 'bigquery.datasets.delete' for all identities ensures that no one, including project owners, can delete the dataset. This is a key part of the scenario's requirements.
- E. Incorrect.
This option is incorrect because the scenario does not mention restricting access based on IP ranges. While it could be an additional layer of security, it is not explicitly required to meet the scenario's requirements.