Google Professional Cloud Security Engineer Question 184
Single answerGoogle Cloud PlatformYour organization has a Google Cloud resource hierarchy that includes an Organization node, multiple folders, and projects. You want to ensure that a specific team has Viewer access to all projects under a folder called 'Team-Folder'. However, the team should not have access to other folders or projects outside of 'Team-Folder.' How can you achieve this using Google Cloud's resource hierarchy and permissions inheritance?
- A
Assign the Viewer role to the team at the Organization level.
- B
Assign the Viewer role to the team at the 'Team-Folder' folder level.
- C
Assign the Viewer role to the team individually on each project under 'Team-Folder'.
- D
Assign the Viewer role to the team at the 'Team-Folder' folder level and deny Viewer access at the Organization level.
Show answer and explanation
Correct answer: B
Explanation
In Google Cloud, permissions can be managed using the resource hierarchy, which includes the Organization node, folders, and projects. Permissions assigned at a higher level (e.g., folder) are inherited by all child resources (e.g., projects). Assigning the Viewer role at the 'Team-Folder' folder level ensures that the team has the required access to all projects under this folder while restricting their access to other folders and projects outside of 'Team-Folder'. This approach leverages the inheritance model effectively and avoids unnecessary complexity.
- A. Incorrect.
Assigning the Viewer role at the Organization level would grant the team access to all resources within the organization, including projects and folders outside of 'Team-Folder', which does not meet the requirement.
- B. Correct.
Assigning the Viewer role at the 'Team-Folder' folder level ensures that the permissions are inherited by all projects within that folder, while not affecting other folders or projects outside of 'Team-Folder'. This is the correct approach according to the resource hierarchy and permissions inheritance model.
- C. Incorrect.
Assigning the Viewer role individually to each project under 'Team-Folder' would achieve the desired access, but it is not scalable or maintainable. It is not the recommended approach.
- D. Incorrect.
Denying Viewer access at the Organization level is not a valid approach in Google Cloud, as Google Cloud IAM does not support deny policies at the Organization level.