An enterprise is designing its Google Cloud resource hierarchy. The organization consists of multiple business units, including a Finance division that manages several sensitive workloads across multiple projects grouped under a Finance folder. The cloud architecture must satisfy the following security and governance requirements: A dedicated Finance security team must be able to administer IAM allow policies exclusively for all resources under the Finance folder. Members of the Finance security team must NOT have direct read, write, or administrative access to the underlying application data or virtual machines. Multiple microservices deployed within the Finance projects require distinct Google Cloud API permissions. Administrative overhead for onboarding and offboarding team members must be minimized. Which combination of IAM and resource governance practices should the cloud architect recommend?

Assign the Folder IAM Admin role (`roles/resourcemanager.folderIamAdmin`) to a Google Group on the `Finance` folder, and provision dedicated, separate service accounts with granular predefined roles for each microservice.: ### What this solution is This approach combines **group-based access control**, the principle of **least privilege**, and specific predefined Resource Manager roles to govern a defined branch of the resource hierarchy. It also establishes distinct trust boundaries for applications using dedicated service accounts. ### How it meets the requirements - **Folder IAM Administration without Data Access**: Granting the **Folder IAM Admin** (`roles/resourcemanager.folderIamAdmin`) role allows the designated security team to manage IAM allow policies across the folder and all its child projects. Crucially, unlike broad administrative roles, Folder IAM Admin does not grant direct read, write, or management access to data resources (such as Cloud Storage objects or Compute Engine instances). - **Separation of Microservice Permissions**: Creating a unique **service account** for each microservice adheres to the practice of treating each application component as an independent trust boundary. Each service account is assigned only the specific predefined roles necessary for its operational tasks. - **Minimized Administrative Overhead**: Assigning roles to a **Google Group** rather than individual user identities allows user lifecycle management (joiners, movers, leavers) to occur within the identity provider or group directory without modifying IAM policy bindings on cloud resources. ### Key advantages and capabilities - **Policy Inheritance**: Applying the role at the folder level ensures consistent governance over all current and future projects nested under the `Finance` folder through automatic policy inheritance. - **Defense in Depth**: Isolates microservice identities so that a compromise of one service does not expose resources required by another. - **Auditability and Governance**: Simplifies compliance reporting and IAM policy reviews by centralizing administrative permissions within a single structured group. ### Why this is optimal This solution provides the precise level of administrative authority requested without over-granting permissions or exposing data payloads, perfectly aligning with enterprise security architecture standards.

StudyCerts

Iam Least Privilege Folder Iam Admin Service Accounts | Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam! | StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Iam Least Privilege Folder Iam Admin Service Accounts

Section: Security and compliance

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise is designing its Google Cloud resource hierarchy. The organization consists of multiple business units, including a Finance division that manages several sensitive workloads across multiple projects grouped under a Finance folder.

The cloud architecture must satisfy the following security and governance requirements:

A dedicated Finance security team must be able to administer IAM allow policies exclusively for all resources under the Finance folder.
Members of the Finance security team must NOT have direct read, write, or administrative access to the underlying application data or virtual machines.
Multiple microservices deployed within the Finance projects require distinct Google Cloud API permissions.
Administrative overhead for onboarding and offboarding team members must be minimized.

Which combination of IAM and resource governance practices should the cloud architect recommend?

Assign the Folder IAM Admin role (roles/resourcemanager.folderIamAdmin) to a Google Group on the Finance folder, and provision dedicated, separate service accounts with granular predefined roles for each microservice.

Assign the Folder Admin role (roles/resourcemanager.folderAdmin) to a Google Group on the Finance folder, and grant the Service Account User role (roles/iam.serviceAccountUser) to all developers at the organization level.

Assign the Organization Administrator role (roles/resourcemanager.organizationAdmin) to individual users on the Finance folder, and assign a single custom IAM role to all microservices across the organization.

Assign the Owner basic role (roles/owner) to individual members of the Finance security team on each project in the Finance folder, and attach the default Compute Engine service account to all microservices.

Professional Cloud Architect

Iam Least Privilege Folder Iam Admin Service Accounts

Related questions