Google Cloud Certified Identity and Access Management 2 — Questions and Answers
Question 1: An application requires access to Cloud SQL from GKE pods. Which approach BEST follows Google's security best practices?
- Mount a service account key as a Kubernetes secret
- Use Workload Identity to bind a Kubernetes service account to a GCP service account (Correct answer)
- Grant the GKE node pool's default service account Cloud SQL Editor
- Use a static username and password stored in environment variables
Correct answer: Use Workload Identity to bind a Kubernetes service account to a GCP service account
Workload Identity is the recommended approach for GKE because it binds Kubernetes service accounts to GCP service accounts, enabling fine-grained access without key files.
Question 2: What does the principle of least privilege mean in the context of IAM?
- Only administrators can modify IAM policies
- Users and services should be granted only the minimum permissions necessary to perform their tasks (Correct answer)
- All users should have viewer access to all resources by default
- Permissions should be granted at the project level to simplify management
Correct answer: Users and services should be granted only the minimum permissions necessary to perform their tasks
Least privilege means granting only the permissions required to perform a specific job function, reducing the blast radius in case of a compromised account.
Question 3: Which tool can be used to analyze and understand what permissions an IAM principal has across a GCP organization?
- Cloud Trace
- Policy Analyzer (IAM Policy Troubleshooter) (Correct answer)
- Cloud Profiler
- Asset Inventory only
Correct answer: Policy Analyzer (IAM Policy Troubleshooter)
Policy Analyzer and IAM Policy Troubleshooter allow you to query and understand effective permissions for a principal across the resource hierarchy.
Question 4: A Cloud Architect needs to prevent any project in the organization from creating service account keys. Which service should be used?
- Cloud Armor
- Organization Policy Service with constraints/iam.disableServiceAccountKeyCreation (Correct answer)
- Cloud Identity
- VPC Service Controls
Correct answer: Organization Policy Service with constraints/iam.disableServiceAccountKeyCreation
The Organization Policy Service with the iam.disableServiceAccountKeyCreation constraint can be applied at the organization level to prevent any project from creating service account keys.
Question 5: What is the maximum number of IAM policy bindings that can be set on a single Cloud Storage bucket?
- 100
- 500
- 1,500 (Correct answer)
- Unlimited
Correct answer: 1,500
Google Cloud IAM policies have a limit of 1,500 members per policy binding and a total of 1,500 policy bindings at the resource level, which architects must plan for in large multi-tenant systems.
Question 6: Which type of service account is automatically created when you enable certain GCP APIs and is managed by Google?
- User-managed service account
- Default service account
- Google-managed service account (Correct answer)
- Cross-project service account
Correct answer: Google-managed service account
Google-managed service accounts (also called Google APIs service agents) are automatically created by Google when APIs are enabled and are used by GCP services internally.
Question 7: A developer accidentally granted the Editor role to an external user at the project level. What is the FASTEST way to remediate this while minimizing disruption?
- Delete the project and recreate it
- Remove the IAM binding for that user at the project level (Correct answer)
- Disable all APIs in the project
- Change the project to a read-only state
Correct answer: Remove the IAM binding for that user at the project level
Removing the specific IAM binding for the user at the project level immediately revokes their access without affecting any other users or project resources.
Google Cloud Certified Identity and Access Management 2
An application requires access to Cloud SQL from GKE pods.
Which approach BEST follows Google's security best practices?