Google Cloud Certified Identity and Access Management 1 — Questions and Answers
Question 1: A company needs to grant a third-party auditor read-only access to specific BigQuery datasets without giving them access to other GCP resources. What is the BEST approach?
- Grant the auditor the Project Viewer role at the project level
- Create a custom IAM role with only BigQuery Data Viewer permissions and assign it at the dataset level (Correct answer)
- Share the dataset using BigQuery authorized views
- Add the auditor to a Google Group with Editor permissions
Correct answer: Create a custom IAM role with only BigQuery Data Viewer permissions and assign it at the dataset level
Creating a custom IAM role with BigQuery Data Viewer and assigning it at the dataset level follows the principle of least privilege, scoping access precisely to what is needed.
Question 2: Which IAM binding type allows you to set conditions on when a role applies to a member, such as restricting access to specific hours or IP ranges?
- Basic bindings
- Conditional bindings (Correct answer)
- Policy bindings
- Service account bindings
Correct answer: Conditional bindings
Conditional bindings (IAM Conditions) allow you to define attribute-based access control rules that restrict when a role applies based on request attributes like time, IP, or resource tags.
Question 3: A service running on a Compute Engine VM needs to call the Cloud Storage API. What is the recommended way to provide credentials?
- Download a service account key JSON file and copy it to the VM
- Hardcode the credentials in the application environment variables
- Attach a service account to the VM instance and use Application Default Credentials (Correct answer)
- Use the project owner's credentials via gcloud auth
Correct answer: Attach a service account to the VM instance and use Application Default Credentials
Attaching a service account to the VM and using Application Default Credentials is the recommended approach because it avoids storing long-lived key files and automatically rotates tokens.
Question 4: Your organization requires that no service account keys older than 90 days exist in the project. Which GCP feature helps you enforce and monitor this?
- Cloud Audit Logs
- Organization Policy constraints with IAM key age enforcement (Correct answer)
- Cloud Security Command Center
- VPC Service Controls
Correct answer: Organization Policy constraints with IAM key age enforcement
Organization Policy constraints can enforce that service account keys are not older than a specified number of days, helping organizations maintain security compliance.
Question 5: What is the purpose of Workload Identity Federation in Google Cloud?
- It federates identities between multiple GCP projects
- It allows external workloads to access GCP resources without service account keys by exchanging short-lived tokens (Correct answer)
- It synchronizes on-premises Active Directory users with Cloud Identity
- It enables cross-organization resource sharing
Correct answer: It allows external workloads to access GCP resources without service account keys by exchanging short-lived tokens
Workload Identity Federation lets external workloads (AWS, Azure, on-prem) authenticate to GCP by exchanging their provider credentials for short-lived GCP tokens, eliminating the need for service account keys.
Question 6: A team wants to grant developers access to deploy to Cloud Run but not to modify IAM policies. Which role satisfies this requirement?
- roles/owner
- roles/run.admin
- roles/run.developer (Correct answer)
- roles/editor
Correct answer: roles/run.developer
The roles/run.developer role grants permission to deploy and manage Cloud Run services without the ability to modify IAM policies on those resources.
Question 7: Which resource hierarchy level is the LOWEST at which an IAM policy can be set in Google Cloud?
- Organization
- Folder
- Project
- Individual resource (Correct answer)
Correct answer: Individual resource
IAM policies can be set at the individual resource level (e.g., a specific Cloud Storage bucket or BigQuery dataset), which is the most granular level in the resource hierarchy.
Google Cloud Certified Identity and Access Management 1
A company needs to grant a third-party auditor read-only access to specific BigQuery datasets without giving them access to other GCP resources.
What is the BEST approach?