Google Professional Cloud Security Engineer Question 155
Select 3Google Cloud PlatformYour organization uses Google Cloud Identity and Access Management (IAM) to manage permissions. To streamline user access control, you decide to assign permissions through Google Groups instead of assigning roles directly to individual users. Which of the following are best practices when managing permissions through groups in Google Cloud?
- A
Use meaningful group names that reflect their purpose or access level.
- B
Assign roles to individual users instead of groups for more granular control.
- C
Regularly review group membership to ensure only authorized users are in the group.
- D
Nest groups to simplify management, but avoid excessive nesting to prevent complexity.
- E
Grant Owner roles to groups for critical projects to ensure full access.
Show answer and explanation
Correct answers: A, C, D
Explanation
Managing permissions through groups in Google Cloud is a scalable and efficient approach. Best practices include using meaningful group names for clarity, regularly reviewing group membership to avoid unauthorized access, and cautiously using nested groups to balance simplicity and clarity. Avoid assigning roles directly to users and granting overly permissive roles like Owner to groups, as these practices contradict the principle of least privilege and increase security risks.
- A. Correct.
Using meaningful group names helps administrators and auditors quickly understand the purpose of each group and reduces the risk of misconfigurations.
- B. Incorrect.
Assigning roles to individual users goes against best practices in Google Cloud, as it creates complexity and makes permission management harder to scale.
- C. Correct.
Regular reviews of group membership are essential to ensure that only authorized users have access, reducing the risk of privilege creep.
- D. Correct.
Nesting groups can simplify management in some cases, but excessive nesting can lead to difficulty in understanding and auditing permissions, so it should be used cautiously.
- E. Incorrect.
Granting Owner roles to groups, especially for critical projects, is not a best practice. Instead, use the principle of least privilege and assign only the permissions required for specific tasks.