Google Professional Cloud Security Engineer Question 185
Single answerGoogle Cloud PlatformYour organization is using Google Cloud and has a resource hierarchy with the following structure: Organization > Folder A > Project X. You need to ensure that a group of developers has the ability to view and edit resources only within Project X but not in any other projects or folders. How should you configure the permissions to achieve this while following the principle of least privilege?
- A
Assign the 'Editor' role to the developers at the Organization level.
- B
Assign the 'Editor' role to the developers at the Folder A level.
- C
Assign the 'Editor' role to the developers at the Project X level.
- D
Assign the 'Viewer' role to the developers at the Organization level and the 'Editor' role at the Project X level.
Show answer and explanation
Correct answer: C
Explanation
To adhere to the principle of least privilege, permissions should only be granted at the lowest level in the resource hierarchy where they are needed. By assigning the 'Editor' role at the Project X level, the developers gain the ability to view and edit resources only within Project X without inheriting unnecessary permissions at higher levels of the hierarchy. This ensures that their access is restricted to the specific project they are working on.
- A. Incorrect.
This would grant the developers access to all resources under the Organization, violating the principle of least privilege.
- B. Incorrect.
This would grant the developers access to all projects and resources under Folder A, including other projects besides Project X, which is not desired.
- C. Correct.
Assigning the 'Editor' role at the Project X level ensures that the developers have the necessary permissions to view and edit resources only within Project X. This approach adheres to the principle of least privilege.
- D. Incorrect.
Assigning the 'Viewer' role at the Organization level would unnecessarily grant the developers read-only access to all resources in the Organization, which does not align with the principle of least privilege. Additionally, the 'Editor' role at Project X level would be sufficient for their needs.