Identity and Access Management Flashcards

A company needs to grant a third-party auditor read-only access to specific BigQuery datasets without giving them access to other GCP resources. What is the BEST approach?

Answer: Create a custom IAM role with only BigQuery Data Viewer permissions and assign it at the dataset level

Creating a custom IAM role with BigQuery Data Viewer and assigning it at the dataset level follows the principle of least privilege, scoping access precisely to what is needed.

Which IAM binding type allows you to set conditions on when a role applies to a member, such as restricting access to specific hours or IP ranges?

Answer: Conditional bindings

Conditional bindings (IAM Conditions) allow you to define attribute-based access control rules that restrict when a role applies based on request attributes like time, IP, or resource tags.

A service running on a Compute Engine VM needs to call the Cloud Storage API. What is the recommended way to provide credentials?

Answer: Attach a service account to the VM instance and use Application Default Credentials

Attaching a service account to the VM and using Application Default Credentials is the recommended approach because it avoids storing long-lived key files and automatically rotates tokens.

Your organization requires that no service account keys older than 90 days exist in the project. Which GCP feature helps you enforce and monitor this?

Answer: Organization Policy constraints with IAM key age enforcement

Organization Policy constraints can enforce that service account keys are not older than a specified number of days, helping organizations maintain security compliance.

What is the purpose of Workload Identity Federation in Google Cloud?

Answer: It allows external workloads to access GCP resources without service account keys by exchanging short-lived tokens

Workload Identity Federation lets external workloads (AWS, Azure, on-prem) authenticate to GCP by exchanging their provider credentials for short-lived GCP tokens, eliminating the need for service account keys.

A team wants to grant developers access to deploy to Cloud Run but not to modify IAM policies. Which role satisfies this requirement?

Answer: roles/run.developer

The roles/run.developer role grants permission to deploy and manage Cloud Run services without the ability to modify IAM policies on those resources.

Which resource hierarchy level is the LOWEST at which an IAM policy can be set in Google Cloud?

Answer: Individual resource

IAM policies can be set at the individual resource level (e.g., a specific Cloud Storage bucket or BigQuery dataset), which is the most granular level in the resource hierarchy.