Google Cloud Certified Identity and Access Management 2

Question 1

An application requires access to Cloud SQL from GKE pods. Which approach BEST follows Google's security best practices?

Accepted Answer

Use Workload Identity to bind a Kubernetes service account to a GCP service account

Answer

Workload Identity is the recommended approach for GKE because it binds Kubernetes service accounts to GCP service accounts, enabling fine-grained access without key files.

Question 2

What does the principle of least privilege mean in the context of IAM?

Accepted Answer

Users and services should be granted only the minimum permissions necessary to perform their tasks

Answer

Least privilege means granting only the permissions required to perform a specific job function, reducing the blast radius in case of a compromised account.

Question 3

Which tool can be used to analyze and understand what permissions an IAM principal has across a GCP organization?

Accepted Answer

Policy Analyzer (IAM Policy Troubleshooter)

Answer

Policy Analyzer and IAM Policy Troubleshooter allow you to query and understand effective permissions for a principal across the resource hierarchy.

Question 4

A Cloud Architect needs to prevent any project in the organization from creating service account keys. Which service should be used?

Accepted Answer

Organization Policy Service with constraints/iam.disableServiceAccountKeyCreation

Answer

The Organization Policy Service with the iam.disableServiceAccountKeyCreation constraint can be applied at the organization level to prevent any project from creating service account keys.

Question 5

What is the maximum number of IAM policy bindings that can be set on a single Cloud Storage bucket?

Accepted Answer

1,500

Answer

Google Cloud IAM policies have a limit of 1,500 members per policy binding and a total of 1,500 policy bindings at the resource level, which architects must plan for in large multi-tenant systems.

Google Cloud Certified - Professional Cloud Architect Practice Test

Google Cloud Certified - Professional Cloud Architect Practice Test

Google Cloud Certified Identity and Access Management 2