ExpertGCP PCA · Question 25 · Domain 3: Designing for Security and Compliance
You are auditing IAM permissions for a GCP project. You notice that several developers have been granted the roles/editor basic role. The security team requires that developers should only have the ability to view resources and manage Compute Engine instances, but they should not be able to modify IAM policies or access Cloud Storage buckets. What should you do?
You are auditing IAM permissions for a GCP project. You notice that several developers have been granted the roles/editor basic role. The security team requires that developers should only have the ability to view resources and manage Compute Engine instances, but they should not be able to modify IAM policies or access Cloud Storage buckets. What should you do?
Answer options:
Keep the roles/editor role, but add a deny policy for Cloud Storage and IAM.
Remove the roles/editor role. Grant the developers the roles/viewer and roles/compute.instanceAdmin.v1 predefined roles.
Create a Custom Role with all permissions from the Editor role, minus the storage and IAM permissions.
Remove the roles/editor role. Grant the roles/owner role to a service account and let developers impersonate it.
How to approach this question
Full Answer
Common mistakes
Practice the full GCP Professional Cloud Architect Practice Exam 3
50 questions · hints · full answers · grading