An enterprise has activated Security Command Center (SCC) at the organization level across their Google Cloud environment. A security engineer needs to configure granular Identity and Access Management (IAM) permissions to fulfill two specific operational requirements: Requirement 1: The central SecOps audit team must have read-only visibility into all assets, security findings, and attack paths across the entire organization hierarchy, without permissions to edit or modify SCC configurations. Requirement 2: A divisional compliance team must be restricted so they can only view discovered inventory assets and security findings located strictly within their specific business unit's folder (Folder-BU1), without viewing attack paths or resources outside that folder. Which combination of IAM role bindings should the security engineer implement?

Grant `roles/securitycenter.adminViewer` to the central SecOps audit team at the organization level, and grant `roles/securitycenter.assetsViewer` and `roles/securitycenter.findingsViewer` to the divisional compliance team at the `Folder-BU1` level.: ### What the Recommended IAM Architecture Is Google Cloud Security Command Center (SCC) uses specialized Identity and Access Management (IAM) predefined roles that align with the resource hierarchy (Organization, Folder, and Project) to enforce least-privilege visibility and administration. ### How It Meets the Stated Requirements - **How it meets Requirement 1 (Central SecOps Audit Visibility):** Granting the **Security Center Admin Viewer** (`roles/securitycenter.adminViewer`) role at the **organization level** provides comprehensive, read-only permissions across the entire organization. It allows the team to inspect all discovered assets, security findings, and attack exposure paths in the Security Command Center console without granting permissions to change configurations, mute findings, or modify detection services. - **How it meets Requirement 2 (Scoped Divisional Access):** Granting the **Security Center Assets Viewer** (`roles/securitycenter.assetsViewer`) and **Security Center Findings Viewer** (`roles/securitycenter.findingsViewer`) roles specifically at the **`Folder-BU1` level** scopes asset and finding visibility strictly to resources nested under that specific folder. It prevents the divisional compliance team from seeing findings, assets, or attack paths elsewhere in the organization hierarchy. ### Key Advantages and Capabilities - **Granular Scoping:** Restricting roles to folder or project nodes leverages IAM inheritance downwards without granting top-level organization exposure. - **Attack Path Protection:** Keeps sensitive attack path simulations restricted to organization-level viewers while giving line-of-business teams only the finding details they need. - **Strict Read-Only Enforcement:** Neither role includes editing permissions (`securitycenter.*.update` or `securitycenter.*.create`), preventing accidental or malicious modification of security baselines. ### Why This Is Optimal This configuration cleanly separates organization-wide administrative auditing from departmental finding reviews, strictly enforcing least privilege through native Google Cloud Resource Manager hierarchy boundaries.

Scc Iam Granular Access Roles | Professional Cloud Security Engineer

Scc Iam Granular Access Roles

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise has activated Security Command Center (SCC) at the organization level across their Google Cloud environment. A security engineer needs to configure granular Identity and Access Management (IAM) permissions to fulfill two specific operational requirements:

Requirement 1: The central SecOps audit team must have read-only visibility into all assets, security findings, and attack paths across the entire organization hierarchy, without permissions to edit or modify SCC configurations.
Requirement 2: A divisional compliance team must be restricted so they can only view discovered inventory assets and security findings located strictly within their specific business unit's folder (Folder-BU1), without viewing attack paths or resources outside that folder.

Which combination of IAM role bindings should the security engineer implement?

Grant roles/securitycenter.admin to the central SecOps audit team at the organization level, and grant roles/securitycenter.adminViewer to the divisional compliance team at the Folder-BU1 level.

Grant roles/securitycenter.findingsViewer and roles/securitycenter.assetsViewer to the central SecOps audit team at the organization level, and grant roles/securitycenter.findingsEditor to the divisional compliance team at the Folder-BU1 level.

Grant roles/securitycentermanagement.admin to the central SecOps audit team at the organization level, and grant roles/securitycenter.settingsViewer to the divisional compliance team at the Folder-BU1 level.

Grant roles/securitycenter.adminViewer to the central SecOps audit team at the organization level, and grant roles/securitycenter.assetsViewer and roles/securitycenter.findingsViewer to the divisional compliance team at the Folder-BU1 level.

Professional Cloud Security Engineer

Scc Iam Granular Access Roles

Related questions