Your organization operates a multi-tier microservices application across multiple Google Cloud projects and environments (e.g., production, staging). As a DevOps engineer, you need to design a centralized Cloud Monitoring dashboard that enables team members to troubleshoot across environments efficiently while maintaining strict security controls. The dashboard design must meet the following requirements: Enable engineers to dynamically filter all tiles across the dashboard by environment and resource labels without modifying underlying queries or duplicating dashboard assets. Grant an external compliance team read-only access to inspect dashboard configurations and layouts without granting them permissions to modify dashboards, create alert policies, or edit notification channels. Which configuration and IAM role assignment should you implement?

Configure `dashboardFilters` at the dashboard level targeting resource and environment labels, and assign the `roles/monitoring.dashboardViewer` role to the compliance team.: ### What the Solution Is This solution implements top-level **`dashboardFilters`** within the Cloud Monitoring dashboard definition and grants the predefined **Monitoring Dashboard Configuration Viewer** (`roles/monitoring.dashboardViewer`) role to the compliance auditors. ### How It Meets the Requirements - **Dynamic Multi-Resource Filtering**: Defining **`dashboardFilters`** allows users to dynamically filter all charts and widgets across the dashboard using template variables and label matching (such as `resource.label.environment` or `resource.label.zone`). This eliminates the need to create separate static dashboard definitions for each environment. - **Least Privilege Access Control**: The **`roles/monitoring.dashboardViewer`** role provides read-only permissions specifically for dashboard metadata and configuration (`monitoring.dashboards.get` and `monitoring.dashboards.list`). It deliberately restricts users from creating, updating, or deleting dashboards, alerting policies, or notification channels. ### Key Advantages and Capabilities - **Centralized Management**: Allows a single unified dashboard template to serve multiple operational tiers and environments. - **Granular Security**: Separates dashboard configuration viewing from operational management and alerting configuration. - **Reduced Maintenance Overhead**: Avoids configuration drift caused by cloning static dashboards for each environment. - **Interactive Troubleshooting**: Allows on-call engineers to pivot across services, clusters, and regions directly within the console UI. ### Why This Is Optimal Using native **`dashboardFilters`** and **`roles/monitoring.dashboardViewer`** strictly satisfies both operational agility and security governance according to Google Cloud best practices.

Cloud Monitoring Dynamic Filtering Secure Dashboard Sharing | Professional Cloud DevOps Engineer

Cloud Monitoring Dynamic Filtering Secure Dashboard Sharing

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

Your organization operates a multi-tier microservices application across multiple Google Cloud projects and environments (e.g., production, staging). As a DevOps engineer, you need to design a centralized Cloud Monitoring dashboard that enables team members to troubleshoot across environments efficiently while maintaining strict security controls.

The dashboard design must meet the following requirements:

Enable engineers to dynamically filter all tiles across the dashboard by environment and resource labels without modifying underlying queries or duplicating dashboard assets.
Grant an external compliance team read-only access to inspect dashboard configurations and layouts without granting them permissions to modify dashboards, create alert policies, or edit notification channels.

Which configuration and IAM role assignment should you implement?

Create separate duplicated dashboard files for each environment, and share dashboards using unauthenticated public links.

Configure dashboardFilters at the dashboard level targeting resource and environment labels, and assign the roles/monitoring.dashboardViewer role to the compliance team.

Configure dashboardFilters at the dashboard level targeting resource labels, and assign the roles/monitoring.editor role with a custom IAM deny policy to the compliance team.

Configure individual static query filters inside each chart tile, and assign the roles/monitoring.editor role to the compliance team.

Professional Cloud DevOps Engineer

Cloud Monitoring Dynamic Filtering Secure Dashboard Sharing

Related questions