Google Cloud Certified Identity and Access Management

Question 1

A company needs to grant a third-party auditor read-only access to specific BigQuery datasets without giving them access to other GCP resources. What is the BEST approach?

Accepted Answer

Create a custom IAM role with only BigQuery Data Viewer permissions and assign it at the dataset level

Answer

Grant the auditor the Project Viewer role at the project level

Answer

Share the dataset using BigQuery authorized views

Answer

Add the auditor to a Google Group with Editor permissions

Question 2

Which IAM binding type allows you to set conditions on when a role applies to a member, such as restricting access to specific hours or IP ranges?

Accepted Answer

Conditional bindings

Answer

Basic bindings

Answer

Policy bindings

Answer

Service account bindings

Question 3

A service running on a Compute Engine VM needs to call the Cloud Storage API. What is the recommended way to provide credentials?

Accepted Answer

Attach a service account to the VM instance and use Application Default Credentials

Answer

Download a service account key JSON file and copy it to the VM

Answer

Hardcode the credentials in the application environment variables

Answer

Use the project owner's credentials via gcloud auth

Question 4

Your organization requires that no service account keys older than 90 days exist in the project. Which GCP feature helps you enforce and monitor this?

Accepted Answer

Organization Policy constraints with IAM key age enforcement

Answer

Cloud Audit Logs

Answer

Cloud Security Command Center

Answer

VPC Service Controls

Question 5

What is the purpose of Workload Identity Federation in Google Cloud?

Accepted Answer

It allows external workloads to access GCP resources without service account keys by exchanging short-lived tokens

Answer

It federates identities between multiple GCP projects

Answer

It synchronizes on-premises Active Directory users with Cloud Identity

Answer

It enables cross-organization resource sharing

Question 6

A team wants to grant developers access to deploy to Cloud Run but not to modify IAM policies. Which role satisfies this requirement?

Accepted Answer

roles/run.developer

Answer

roles/owner

Answer

roles/run.admin

Answer

roles/editor

Question 7

Which resource hierarchy level is the LOWEST at which an IAM policy can be set in Google Cloud?

Accepted Answer

Individual resource

Answer

Organization

Answer

Folder

Answer

Project