Google Professional Cloud Security Engineer Question 181
Select 3Google Cloud PlatformYour organization is setting up a new Google Cloud project for a sensitive financial application. You need to ensure that developers working on this project do not have the ability to create or delete GCP resources across the organization, but they should be able to make changes within this specific project. Which of the following steps should you take to configure this access control effectively while leveraging the Google Cloud resource hierarchy?
- A
Assign the 'Project Editor' role to the developers at the project level.
- B
Assign the 'Organization Viewer' role to the developers at the organization level.
- C
Restrict developers' access at the organization level by explicitly denying permissions.
- D
Ensure that inherited permissions from the folder or organization level do not grant unnecessary access to developers at the project level.
- E
Use custom roles to configure granular permissions for developers and assign them at the project level.
Show answer and explanation
Correct answers: A, D, E
Explanation
To implement effective access control while leveraging the Google Cloud resource hierarchy, you should assign roles at the project level (such as 'Project Editor') to grant necessary permissions and avoid granting permissions at higher levels in the hierarchy unless required. Additionally, reviewing permission inheritance and using custom roles for granular access control helps adhere to the principle of least privilege, ensuring developers have access only to what they need for their work within the specific project.
- A. Correct.
Assigning the 'Project Editor' role at the project level ensures developers can make changes within the project but does not grant them unnecessary permissions at higher levels like the organization or folder.
- B. Incorrect.
Assigning the 'Organization Viewer' role at the organization level is unnecessary for this scenario and does not restrict developers' ability to create or delete resources.
- C. Incorrect.
Explicitly denying permissions at the organization level is not required in this case. Google Cloud IAM does not support explicit deny policies at the resource level; access is denied by default if not granted explicitly.
- D. Correct.
Ensuring that inherited permissions from higher levels do not grant unnecessary access is critical for maintaining the principle of least privilege. You should review and adjust the resource hierarchy to avoid unintended access inheritance.
- E. Correct.
Using custom roles to configure granular permissions and assigning them at the project level allows you to fine-tune access for the developers, ensuring they have only the permissions they need without broader access.