Google Professional Cloud Security Engineer Question 28
Select 3Google Cloud PlatformYour organization uses Google Cloud Identity and Access Management (IAM) to manage permissions. You need to programmatically add a new user to a group and ensure that the user is granted the appropriate IAM role to access a specific resource. Which steps should you take to accomplish this using Google Cloud APIs?
- A
Use the Cloud Identity Groups API to add the user to the group.
- B
Use the IAM API to grant the user a role directly on the resource.
- C
Use the Groups Settings API to configure the group’s access level for the resource.
- D
Use the IAM API to grant the group a role on the resource.
- E
Use the Admin SDK Directory API to create the user account.
Show answer and explanation
Correct answers: A, D, E
Explanation
To manage user accounts and permissions programmatically in Google Cloud, you should first create the user account using the Admin SDK Directory API if it doesn’t exist. Then, use the Cloud Identity Groups API to add the user to the appropriate group. Finally, assign the necessary IAM role to the group on the resource using the IAM API. This approach follows best practices for scalability and ease of management.
- A. Correct.
Correct: The Cloud Identity Groups API allows you to programmatically manage group memberships, including adding users to groups.
- B. Incorrect.
Incorrect: Granting roles directly to users is not recommended in this case since using groups is a best practice for managing permissions at scale.
- C. Incorrect.
Incorrect: The Groups Settings API is used for configuring G Suite group settings (e.g., email permissions) but is not relevant for IAM permissions.
- D. Correct.
Correct: Assigning an IAM role to a group ensures all group members inherit the permissions, which is a scalable and manageable approach.
- E. Correct.
Correct: The Admin SDK Directory API is used to create and manage user accounts programmatically, which is necessary if the user does not already exist in your domain.