Access control (IAM vs ACLs) in GCP - Practice Questions

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding IAM vs ACLs in GCP

Which statement correctly describes the difference between IAM and ACLs in Google Cloud Platform?

A ACLs replace IAM roles and are the recommended way to manage permissions across all GCP services.

B IAM controls access at the project or resource level using roles, while ACLs control access at the individual object level, such as files in Cloud Storage.

C IAM is used only for network security, while ACLs manage user permissions for all resources.

D IAM and ACLs are identical and can be used interchangeably for all GCP resources.

💡 Hint

Think about the scope of control each method provides.

IAM provides role-based access control at the project or resource level, while ACLs are more granular and often used for individual objects like files in Cloud Storage.

❓ Architecture

intermediate

Choosing Access Control for Cloud Storage

You want to allow a specific user to read only one file in a Cloud Storage bucket without giving access to the entire bucket. Which access control method should you use?

A Assign an IAM role with read permission on the entire bucket to the user.

B Use IAM to grant the user owner permissions on the project.

C Create a new project and move the file there to isolate access.

D Use an ACL to grant read permission on the specific file to the user.

💡 Hint

Consider the granularity of permissions needed.

ACLs allow you to set permissions on individual objects like files, so you can grant read access to just one file without exposing the whole bucket.

❓ security

advanced

Impact of Overly Broad IAM Roles

What is the most likely security risk if a user is granted the 'Owner' IAM role on a GCP project?

A The user can create, modify, and delete any resource, potentially causing accidental or malicious damage.

B The user can only view resources but cannot make changes.

C The user can only access billing information but not resources.

D The user is restricted to read-only access on all resources.

💡 Hint

Think about what the 'Owner' role allows in GCP.

The 'Owner' role grants full control over all resources in the project, including creating, modifying, and deleting resources, which can lead to security risks if misused.

❓ service_behavior

advanced

Effect of Removing ACLs on Cloud Storage Objects

If you remove all ACL entries from a Cloud Storage object, what will be the effect on access to that object?

A The object becomes publicly accessible to anyone on the internet.

B The object remains accessible to all users who had ACL permissions before removal.

C Only users with IAM permissions on the bucket or project can access the object.

D The object is deleted automatically by Cloud Storage.

💡 Hint

Consider how access is controlled when ACLs are empty.

Without ACLs, access to the object depends on IAM permissions set at the bucket or project level. The object is not public by default.

✅ Best Practice

expert

Best Practice for Managing Access in Large GCP Environments

In a large organization with many teams and projects, what is the best practice for managing access control to ensure security and ease of management?

A Use IAM groups and predefined roles to assign permissions, minimizing direct user assignments and using ACLs only when necessary.

B Assign IAM roles directly to individual users on each project to keep control tight.

C Rely solely on ACLs for all resources to have fine-grained control at the object level.

D Grant all users the Owner role on projects to avoid permission issues.

💡 Hint

Think about scalability and security in large teams.

Using IAM groups and predefined roles simplifies management and improves security by avoiding direct user assignments and limiting ACL use to specific cases.