Custom roles creation in GCP - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Custom Role Permissions Scope

You create a custom role in Google Cloud Platform (GCP). Which statement correctly describes the scope of permissions you can assign to this custom role?

A You can assign permissions only if you have Owner role on the project.

B You can only assign permissions from services enabled in your project or organization.

C You can assign permissions only from the Compute Engine service.

D You can assign any permissions available in GCP, including those from services not enabled in your project.

💡 Hint

Think about whether permissions depend on enabled services or the full GCP permission set.

Custom roles can include any permissions available in GCP, regardless of whether the service is enabled in your project. This allows flexibility in role design.

❓ Configuration

intermediate

Valid JSON for Creating a Custom Role

Which JSON snippet correctly defines a custom role with title 'Data Viewer', description 'Can view data', and permissions to read BigQuery datasets?

A

{
  "roleId": "dataViewer",
  "role": {
    "title": "Data Viewer",
    "description": "Can view data",
    "includedPermissions": ["bigquery.datasets.get", "bigquery.tables.get"]
  }
}

B

{
  "roleId": "dataViewer",
  "role": {
    "title": "Data Viewer",
    "description": "Can view data",
    "permissions": ["bigquery.datasets.get", "bigquery.tables.get"]
  }
}

C

{
  "id": "dataViewer",
  "role": {
    "title": "Data Viewer",
    "description": "Can view data",
    "includedPermissions": ["bigquery.datasets.get"]
  }
}

D

{
  "roleId": "dataViewer",
  "title": "Data Viewer",
  "description": "Can view data",
  "includedPermissions": ["bigquery.datasets.get", "bigquery.tables.get"]
}

💡 Hint

Check the correct key names for permissions and role ID in the JSON structure.

The correct JSON uses 'roleId' for the role identifier and 'includedPermissions' inside the 'role' object to list permissions.

❓ Architecture

advanced

Best Practice for Custom Role Assignment Scope

You want to assign a custom role to users but limit their permissions only to a specific project. Which is the best practice to achieve this?

A Create the custom role at the project level and assign it at the project level.

B Create the custom role at the project level and assign it at the organization level.

C Create the custom role at the organization level and assign it at the project level.

D Create the custom role at the folder level and assign it at the organization level.

💡 Hint

Consider where the role is created and where it is assigned to limit scope.

Creating and assigning the custom role at the project level limits permissions strictly to that project, following the principle of least privilege.

❓ security

advanced

Security Risk of Overly Broad Custom Roles

What is a key security risk when creating a custom role that includes too many permissions?

A Users may be unable to perform any actions due to lack of permissions.

B The custom role will automatically be disabled by GCP security checks.

C Users may gain unintended access to sensitive resources, increasing risk of data leaks.

D The custom role will cause billing to increase automatically.

💡 Hint

Think about what happens if users have more permissions than needed.

Assigning too many permissions can let users access sensitive data or perform actions beyond their job needs, increasing security risks.

❓ service_behavior

expert

Effect of Deleting a Custom Role in Use

What happens immediately after deleting a custom role that is currently assigned to users in GCP?

A Users keep the permissions from the deleted custom role until their next login, then lose them.

B Users immediately lose all permissions granted by the deleted custom role.

C Users keep the permissions permanently even after role deletion.

D GCP automatically replaces the deleted custom role with a predefined role.

💡 Hint

Consider how GCP enforces permissions when roles are removed.

When a custom role is deleted, all permissions granted by that role are immediately revoked from users assigned to it.