Associate Cloud EngineerDemo

By Google · Question Mode

QuestionQ17

Configuring access and security

An external member of your team needs list access to compute images and disks in one of your projects. You want to follow Google-recommended practices when you grant the required permissions to this user. What should you do?

  • A Create a custom role, and add all the required compute.disks.list and compute.images.list permissions as includedPermissions. Grant the custom role to the user at the project level.
  • B Create a custom role based on the Compute Image User role. Add the compute.disks.list to the includedPermissions field. Grant the custom role to the user at the project level.
  • C Create a custom role based on the Compute Storage Admin role. Exclude unnecessary permissions from the custom role. Grant the custom role to the user at the project level.
  • D Grant the Compute Storage Admin role at the project level.
Explanation

Creating a custom role with only compute.disks.list and compute.images.list permissions follows the principle of least privilege, granting exactly the access needed. Basing a custom role on pre-defined roles (B, C) includes unnecessary additional permissions. Assigning Compute Storage Admin (D) grants excessive permissions beyond what the external user requires.

Community Discussion

No comments yet. Be the first to start the discussion!