Least privilege principle in GCP - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Least Privilege Principle in GCP IAM

Which of the following best describes the least privilege principle when assigning IAM roles in Google Cloud Platform?

A Grant users only the permissions they need to perform their tasks and no more.

B Grant users all permissions to avoid access issues and simplify management.

C Assign roles based on the user's seniority rather than their job function.

D Give users broad permissions initially and reduce them later if problems arise.

💡 Hint

Think about security risks of giving too many permissions.

The least privilege principle means giving users only the permissions they need to do their job, reducing security risks.

❓ Architecture

intermediate

Designing IAM Roles for a Multi-Team GCP Project

You have three teams: Developers, QA, and Operations. Each team needs access to different GCP resources. How should you apply the least privilege principle when assigning IAM roles?

A Create custom roles with only the necessary permissions for each team and assign those roles accordingly.

B Assign the Owner role to all teams to ensure full access and avoid permission errors.

C Assign the Viewer role to all teams and escalate permissions only when requested.

D Use predefined roles like Editor for all teams since they cover most permissions.

💡 Hint

Consider how to limit permissions to only what each team needs.

Creating custom roles tailored to each team's needs follows the least privilege principle and improves security.

❓ security

advanced

Impact of Over-Permissive IAM Roles

What is the most likely security risk if a GCP user is assigned the roles/editor role instead of a more restrictive custom role following the least privilege principle?

A The user will only have read-only access, limiting their ability to work effectively.

B The user can accidentally or maliciously modify or delete resources beyond their job scope, increasing risk of data loss or service disruption.

C The user will be automatically logged out after 5 minutes due to security policies.

D The user will be unable to perform any tasks because Editor role has no permissions.

💡 Hint

Think about what permissions the Editor role grants compared to a minimal role.

The Editor role grants broad permissions that can lead to accidental or intentional harmful changes, violating least privilege.

❓ service_behavior

advanced

Effect of Least Privilege on Automated GCP Service Accounts

An automated service account is used by a deployment pipeline in GCP. Which practice aligns with the least privilege principle to minimize security risks?

A Assign the service account the Owner role to ensure it can deploy anything without errors.

B Use the default Compute Engine service account with all permissions for simplicity.

C Assign the service account only the specific permissions needed to deploy resources it manages, not full project access.

D Disable the service account after each deployment to prevent misuse.

💡 Hint

Consider how to limit automated account permissions to only what is necessary.

Limiting service account permissions to only what is needed reduces risk if the account is compromised.

✅ Best Practice

expert

Implementing Least Privilege with GCP IAM Conditions

You want to enforce least privilege by restricting a user’s access to a GCP Storage bucket only during business hours (9 AM to 5 PM). Which IAM feature allows you to implement this restriction?

A Manually enable and disable the user’s access each day at 9 AM and 5 PM.

B Create a custom role without any time restrictions and assign it to the user.

C Use VPC Service Controls to restrict access based on IP address only.

D Use IAM Conditions to add a time-based condition on the user’s role binding for the bucket.

💡 Hint

Think about how to automate access restrictions based on time.

IAM Conditions allow you to add rules like time-based access restrictions, supporting least privilege dynamically.