Google Cloud Certified Professional Cloud Network Engineer Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose C1

  The correct option is C. To follow the least privilege principle, you should only grant the service account the minimum permissions required to perform the necessary actions. In this case, to allow the automation to retrieve files from Cloud Storage, granting read-only access to the bucket is the most restrictive and appropriate permission. This ensures the service account can access and retrieve the files without granting unnecessary permissions.

• Chose C1

  To adhere to the principle of least privilege in an automation scenario requiring file retrieval from a Cloud Storage bucket, it is advisable to choose option C, which involves granting read-only privileges (e.g., roles/storage.objectViewer) specifically to the service account associated with the task. This approach ensures that the service account has the minimum necessary permissions to access and retrieve files from the designated Cloud Storage bucket, reducing the risk of unauthorized actions and maintaining a more secure and focused access control. Options A and B provide broader permissions that go beyond the specific requirement, while option D grants excessive privileges across various services, deviating from the principle of least privilege.

• Chose C1

  Option C is the most appropriate solution for this scenario, as it provides the least privilege required for the automation to retrieve files from a Cloud Storage bucket. Granting read-only privilege to the service account for the Cloud Storage bucket will allow the automation to only access the files within the bucket without the ability to modify or delete them. Option A is not appropriate, as granting the compute.instanceAdmin privilege to the user account would give it more privileges than necessary, and is not directly related to accessing the Cloud Storage bucket. Option B is also not appropriate, as granting the iam.serviceAccountUser privilege to the user account would not directly allow it to access the Cloud Storage bucket. Option D is overly permissive, as granting the cloud-platform privilege to the service account for the Cloud Storage bucket would provide unnecessary access to all Google Cloud services, which could pose security risks.