Google Professional Cloud Security Engineer Question 183
Select 2Google Cloud PlatformYour company has recently adopted Google Cloud and implemented a resource hierarchy consisting of an organization node, multiple folders for different business units, and projects within each folder. You want to ensure that all developers in the 'Engineering' folder have the 'Viewer' role on all projects within that folder, but you also want to restrict access to a specific project, 'Project X,' so that only a few senior engineers have access. How can you achieve this using IAM and the resource hierarchy?
- A
Assign the 'Viewer' role to the 'Engineering' folder for all developers and assign the 'Viewer' role for 'Project X' only to senior engineers.
- B
Assign the 'Viewer' role to all developers on the organization node and then remove the role from 'Project X' for all developers except senior engineers.
- C
Assign the 'Viewer' role to individual projects within the 'Engineering' folder instead of the folder itself.
- D
Assign the 'Viewer' role to the 'Engineering' folder for all developers and then use a custom IAM policy to deny access to 'Project X' for all developers except senior engineers.
- E
Assign the 'Viewer' role to the 'Engineering' folder for all developers and override the inherited permissions on 'Project X' by assigning specific roles to senior engineers for that project.
Show answer and explanation
Correct answers: A, E
Explanation
Using the resource hierarchy for access control is an efficient way to manage permissions in Google Cloud. Assigning the 'Viewer' role to the 'Engineering' folder ensures all developers inherit permissions across all projects within the folder. To restrict access to 'Project X,' you can override inherited roles at the project level by assigning roles directly to senior engineers. This approach leverages the inheritance model while maintaining granular control over specific resources.
- A. Correct.
This is correct because assigning the 'Viewer' role at the folder level ensures permissions are inherited across all projects in the folder. Restricting access to 'Project X' can then be handled at the project level by assigning roles only to senior engineers, overriding the inheritance.
- B. Incorrect.
This is incorrect because removing permissions at the project level for specific users is not a recommended approach since IAM does not support explicit 'deny' rules for this purpose.
- C. Incorrect.
This is incorrect because assigning roles to individual projects instead of using the folder-level hierarchy leads to unnecessary complexity and undermines the benefits of inheritance.
- D. Incorrect.
This is incorrect because Google Cloud IAM does not currently support a custom deny policy to restrict access in this manner.
- E. Correct.
This is correct because overriding inherited permissions at the 'Project X' level allows you to restrict access to senior engineers while keeping other projects in the folder accessible to all developers.