Why advanced IAM matters in GCP - Test Your Understanding

Practice - 5 Tasks

1fill in blank

easy

Complete the code to assign a role to a user in GCP IAM.

GCP

gcloud projects add-iam-policy-binding my-project --member='user:[e-mail]' --role=[1]

Drag options to blanks, or click blank then click option'

Aroles/storage.objectAdmin

Broles/owner

Croles/editor

Droles/viewer

Attempts:

3 left

💡 Hint

Common Mistakes

Assigning overly broad roles like owner or editor unnecessarily.

The roles/viewer role grants read-only access, which is a basic and safe permission to assign.

2fill in blank

medium

Complete the code to create a custom IAM role with specific permissions.

GCP

gcloud iam roles create customRole --project=my-project --permissions=[1] --title='Custom Role'

Drag options to blanks, or click blank then click option'

Acompute.instances.start,compute.instances.stop

Bstorage.buckets.delete,storage.objects.create

Cstorage.buckets.get,storage.objects.list

Diam.roles.create,iam.roles.delete

Attempts:

3 left

💡 Hint

Common Mistakes

Choosing permissions that allow deleting or creating resources when only read access is needed.

These permissions allow read access to storage buckets and objects, suitable for a custom read-only role.

3fill in blank

hard

Fix the error in the IAM policy binding command to grant a service account the correct role.

GCP

gcloud projects add-iam-policy-binding my-project --member=[1] --role='roles/storage.objectViewer'

Drag options to blanks, or click blank then click option'

AserviceAccount:[e-mail]

Buser:[e-mail]

Cgroup:[e-mail]

Ddomain:[e-mail]

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'user:' prefix for service accounts.

Service accounts must be specified with the prefix serviceAccount: to be recognized correctly.

4fill in blank

hard

Fill both blanks to create a conditional IAM binding that grants access only if the request comes from a specific IP range.

GCP

gcloud projects add-iam-policy-binding my-project --member=[1] --role='roles/storage.objectViewer' --condition='expression=[2],title=IPRestriction'

Drag options to blanks, or click blank then click option'

Auser:[e-mail]

BipInCidr(request.sourceIp, '192.168.1.0/24')

Crequest.time < timestamp('2025-01-01T00:00:00Z')

Duser:[e-mail]

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong member types or incorrect condition expressions.

The condition restricts access to requests coming from the IP range 192.168.1.0/24 for the specified user.

5fill in blank

hard

Fill all three blanks to define a least privilege IAM policy binding with a condition on device security status.

GCP

gcloud projects add-iam-policy-binding my-project --member=[1] --role=[2] --condition='expression=[3],title=DeviceSecurityCheck'

Drag options to blanks, or click blank then click option'

Auser:[e-mail]

Broles/iam.securityReviewer

Cdevice.trustedPlatformModulePresent == true

Droles/editor

Attempts:

3 left

💡 Hint

Common Mistakes

Assigning broad roles like editor or missing the condition expression.

This binding grants the security reviewer role only if the device is trusted, following least privilege principles.