Why IAM is foundational in GCP - Challenge Your Understanding

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding IAM Roles in GCP

Which statement best describes the purpose of IAM roles in Google Cloud Platform?

A IAM roles are used to create virtual machines in GCP.

B IAM roles define what actions a user or service account can perform on resources.

C IAM roles store data securely in Google Cloud Storage.

D IAM roles monitor network traffic between services.

💡 Hint

Think about how GCP controls who can do what.

IAM roles specify permissions that allow users or services to perform specific actions on GCP resources.

❓ Architecture

intermediate

IAM and Resource Hierarchy

In GCP, where should you assign IAM policies to ensure permissions apply to all projects within an organization?

A At the individual VM instance level

B At the billing account level

C At the organization level

D At the Cloud Storage bucket level

💡 Hint

Consider the highest level in the resource hierarchy.

Assigning IAM policies at the organization level applies permissions to all projects and resources under it.

❓ security

advanced

Least Privilege Principle with IAM

Which IAM practice best supports the principle of least privilege in GCP?

A Sharing user credentials to reduce management overhead

B Assigning all users the Owner role for simplicity

C Using default service accounts with broad permissions

D Granting users only the permissions they need to perform their tasks

💡 Hint

Think about minimizing access rights.

Granting only necessary permissions reduces risk and limits potential damage from compromised accounts.

❓ service_behavior

advanced

Effect of IAM Policy Changes

What happens immediately after an IAM policy is updated on a GCP resource?

A The new permissions take effect instantly across all affected services.

B Permissions update only after a 24-hour delay.

C The resource must be restarted for changes to apply.

D Users must log out and log back in to see changes.

💡 Hint

Consider how cloud services handle access control updates.

IAM policy changes are applied immediately, ensuring quick enforcement of new permissions.

✅ Best Practice

expert

Managing Service Account Keys Securely

Which practice is the most secure way to manage service account keys in GCP?

A Avoid creating long-lived service account keys and use short-lived credentials instead.

B Store service account keys in a public GitHub repository for easy access.

C Share service account keys via email to team members.

D Use the same service account key for multiple projects indefinitely.

💡 Hint

Think about minimizing risk if keys are exposed.

Using short-lived credentials reduces the risk of key compromise and limits exposure time.