Google Cloud Certified Identity and Access Management

Question 1

A company needs to grant a third-party auditor read-only access to specific BigQuery datasets without giving them access to other GCP resources. What is the BEST approach?

Accepted Answer

Create a custom IAM role with only BigQuery Data Viewer permissions and assign it at the dataset level

Answer

Creating a custom IAM role with BigQuery Data Viewer and assigning it at the dataset level follows the principle of least privilege, scoping access precisely to what is needed.

Question 2

Which IAM binding type allows you to set conditions on when a role applies to a member, such as restricting access to specific hours or IP ranges?

Accepted Answer

Conditional bindings

Answer

Conditional bindings (IAM Conditions) allow you to define attribute-based access control rules that restrict when a role applies based on request attributes like time, IP, or resource tags.

Question 3

A service running on a Compute Engine VM needs to call the Cloud Storage API. What is the recommended way to provide credentials?

Accepted Answer

Attach a service account to the VM instance and use Application Default Credentials

Answer

Attaching a service account to the VM and using Application Default Credentials is the recommended approach because it avoids storing long-lived key files and automatically rotates tokens.

Question 4

Your organization requires that no service account keys older than 90 days exist in the project. Which GCP feature helps you enforce and monitor this?

Accepted Answer

Organization Policy constraints with IAM key age enforcement

Answer

Organization Policy constraints can enforce that service account keys are not older than a specified number of days, helping organizations maintain security compliance.

Question 5

What is the purpose of Workload Identity Federation in Google Cloud?

Accepted Answer

It allows external workloads to access GCP resources without service account keys by exchanging short-lived tokens

Answer

Workload Identity Federation lets external workloads (AWS, Azure, on-prem) authenticate to GCP by exchanging their provider credentials for short-lived GCP tokens, eliminating the need for service account keys.

Google Cloud Certified - Professional Cloud Architect Practice Test

Google Cloud Certified - Professional Cloud Architect Practice Test

Google Cloud Certified Identity and Access Management