Why advanced IAM matters in GCP - Challenge Your Understanding

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding IAM Role Granularity

Which of the following best explains why using very broad IAM roles (like Owner) for all users is a bad practice?

A It makes it easier to manage permissions because everyone has the same access.

B It increases the risk of accidental or malicious changes because users have more permissions than needed.

C It reduces the number of API calls needed to check permissions.

D It automatically encrypts all data in the project.

💡 Hint

Think about what happens if someone has more access than they really need.

Broad roles give users more permissions than necessary, increasing the chance of mistakes or misuse. Principle of least privilege helps reduce this risk.

❓ security

intermediate

Identifying Risky IAM Configurations

Which IAM configuration below creates the highest security risk in a Google Cloud project?

A Granting the 'roles/owner' role to a user who only needs to read logs.

B Granting the 'roles/editor' role to a service account used only by a specific app.

C Granting the 'roles/viewer' role to a user on a single storage bucket.

D Granting the 'roles/logging.viewer' role to a user who monitors logs.

💡 Hint

Consider the principle of least privilege and what each role allows.

Giving Owner role to someone who only needs to read logs grants far more permissions than necessary, increasing risk.

❓ Architecture

advanced

Designing IAM for a Multi-Team Project

You have three teams: Developers, QA, and Operations. Developers need to deploy apps, QA needs to run tests but not deploy, and Operations needs to manage infrastructure but not code. Which IAM setup best fits these needs?

A Assign 'roles/owner' to all teams for simplicity.

B Assign 'roles/editor' to Developers, 'roles/viewer' to QA, and 'roles/owner' to Operations.

C Assign 'roles/viewer' to all teams and escalate permissions when needed.

D Assign custom roles: Developers get deploy permissions, QA get test execution permissions, Operations get infrastructure management permissions.

💡 Hint

Think about giving only the permissions each team needs.

Custom roles allow precise permission assignment matching each team's responsibilities, improving security and efficiency.

❓ service_behavior

advanced

Effect of Over-Permissive IAM on Service Behavior

What is a likely outcome if a service account used by an app has the 'roles/storage.admin' role instead of a more limited role?

A The app can create, delete, and modify all storage buckets and objects, increasing risk if compromised.

B The app automatically encrypts all data stored.

C The app will fail to access storage buckets due to insufficient permissions.

D The app can only read storage buckets but cannot modify them.

💡 Hint

Consider what 'storage.admin' allows compared to limited roles.

'roles/storage.admin' grants full control over storage resources, so if the app or its credentials are compromised, an attacker can cause serious damage.

✅ Best Practice

expert

Implementing Least Privilege with IAM Conditions

You want to allow a user to start Compute Engine instances only during business hours (9am-5pm). Which IAM feature should you use to enforce this?

A Assign the 'roles/compute.instanceAdmin' role without restrictions.

B Use VPC firewall rules to block access outside business hours.

C Use IAM Conditions to restrict the 'compute.instanceAdmin' role to business hours.

D Create a custom role without any time restrictions.

💡 Hint

Think about how to limit permissions based on time.

IAM Conditions allow you to add rules like time-based restrictions to roles, enforcing least privilege dynamically.