Google Professional Cloud Security Engineer Question 151
Single answerGoogle Cloud PlatformYour organization is using Google Cloud IAM to manage access to resources. To simplify permission management, you decide to leverage Google Groups. One of your teams, the 'DevOps Team,' requires access to multiple resources across different projects. What is the best approach to manage permissions for this team using groups?
- A
Create a Google Group for the 'DevOps Team,' add all team members to the group, and assign IAM roles to the group.
- B
Assign IAM roles directly to each individual user in the 'DevOps Team' to ensure specific permissions.
- C
Create a separate Google Group for each project, add the 'DevOps Team' members to each group, and assign project-specific roles to these groups.
- D
Add 'DevOps Team' members to an existing Google Group that already has the required permissions for other unrelated teams.
Show answer and explanation
Correct answer: A
Explanation
Using Google Groups to manage permissions is a best practice in Google Cloud IAM. By creating a dedicated group for the 'DevOps Team' and assigning IAM roles to the group, you ensure centralized and efficient permission management. This approach reduces administrative overhead and maintains security by adhering to the principle of least privilege.
- A. Correct.
This is the correct approach. Creating a Google Group for the 'DevOps Team' and assigning IAM roles to the group simplifies permission management. Changes to team membership automatically update access without requiring direct IAM role modifications.
- B. Incorrect.
Assigning IAM roles directly to individual users makes management more complex and prone to errors. It is not a recommended best practice for managing permissions at scale.
- C. Incorrect.
While this approach may work, it introduces unnecessary complexity by creating multiple groups per project. A single group for the 'DevOps Team' is simpler and more efficient if their access needs span multiple projects.
- D. Incorrect.
Adding the team to an existing group that has permissions for unrelated teams is not secure or aligned with the principle of least privilege. Permissions should be specific to the 'DevOps Team.'