1.4 Managing and Implementing Authorization Controls PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the purpose of an IAM condition in a role binding?

   • ATo define the expiration date of the role binding.
   • BTo combine multiple roles into a single binding.
   • CTo specify which users in a group can assume the role.
   • DTo restrict access based on attributes like time, resource, or request context.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A contractor needs temporary access to a Compute Engine instance in your project to perform a one-time migration. The access should be limited to the next 48 hours and only from the contractor's corporate IP address. You need to grant this access using IAM. What should you do?

   • AUse Access Context Manager to create a policy that allows access only from the contractor's IP and attach it to the project.
   • BCreate an IAM policy binding with the Compute Instance Admin role and an IAM condition that checks the request time and the source IP address.
   • CGrant the Compute Instance Admin role and manually remove it after 48 hours.
   • DCreate a new service account with the Compute Instance Admin role and give the contractor the key.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the primary purpose of an IAM deny policy?

   • ATo explicitly prevent an identity from performing specific actions, even if a role grants them.
   • BTo grant permissions to a user that they do not currently have.
   • CTo replace the need for IAM roles in a project.
   • DTo automatically remove a user's access after a certain period.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   Your security team has identified that a user has the Owner role on a project, but the user only needs to manage Cloud Storage resources. You need to determine the minimal set of permissions the user actually uses and recommend a least-privilege role. You also need to ensure that the recommendation is based on actual usage data. What should you do?

   • AGrant the user the Storage Admin role and remove the Owner role.
   • BUse Policy Analyzer to list all permissions the user has and manually compare them to the Storage Admin role.
   • CUse the IAM Recommender to get a role recommendation based on the user's recent activity.
   • DReview the audit logs to see which permissions the user has used in the last 90 days.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   A user reports they cannot access a resource. Which Policy Intelligence tool should be used to determine why the access is failing?

   • AIAM Recommender
   • BPolicy Analyzer
   • CPolicy Troubleshooter
   • DCloud Audit Logs
   Reveal Solution Discussion Select an answer first