QuestionQ67

Platform operations

Your organization uses Cloud Identity as its identity provider (IdP) and is a Google Security Operations (SecOps) customer. You need to grant a user group access to the Google SecOps instance with read-only access to every resource, including detection engine rules. How should this be configured?

  • A Create a Google Group and add the required users. Grant the roles/chronicle.Viewer IAM role to the group on the project associated with your Google SecOps Instance.
  • B Create a Google Group and add the required users. Grant the roles/chronicle.limitedViewer IAM role to the group on the project associated with your Google SecOps instance.
  • C Create a workforce identity pool at the organization level. Grant the roles/chronicle.editor IAM role to the principalSet://iam.googleapis.com/locations/global/workforcePools/POOL_ID/group/GROUP_ID principal set on the project associated with your Google SecOps instance.
  • D Create a workforce identity pool at the organization level Grant the roles/chronicle.limitedViewer IAM role to the principalSet://iam.googleapis.com/locations/global/workforcePools/POOL_ID/group/GROUP_ID principal set on the project associated with your Google SecOps Instance.
Explanation

The roles/chronicle.viewer role grants read-only access to Google SecOps application and API resources, including the permissions required to view detection engine rules. roles/chronicle.limitedViewer excludes Rules and Retrohunts. Cloud Identity users can be placed in a Google Group and granted the Viewer role on the project associated with the Google SecOps instance.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!