Vpc Sc Role Based Rules Iam Policy Limitation | Professional Cloud Security Engineer | StudyCerts

Professional Cloud Security Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Vpc Sc Role Based Rules Iam Policy Limitation

Section: Managing privileged roles and separation of duties with Identity and Access Management (IAM) roles and permissions.

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise organization is designing a separation of duties (SoD) framework across multiple Google Cloud projects protected by VPC Service Controls (VPC SC) perimeters. The security team wants to define role-based ingress and egress rules to allow developers to perform specific operations across perimeters while strictly isolating administrative privilege assignment and preventing unauthorized cross-perimeter IAM modifications.

Which constraint or limitation regarding role-based ingress and egress rules must the security team account for when architecting this separation of duties model?

Deleting a custom IAM role referenced in perimeter ingress or egress rules automatically purges the reference without administrative intervention.

Role-based perimeter rules automatically evaluate and authorize multi-project operations across distributed services like Cloud Dataflow without additional configuration.

Predefined IAM roles such as roles/iam.denyReviewer automatically bypass role-based perimeter validation when assigned at the organization level.

Role-based ingress and egress rules cannot be configured to allow requests that set the IAM allow policy (setIamPolicy) on a project across perimeter boundaries.

Professional Cloud Security Engineer

Vpc Sc Role Based Rules Iam Policy Limitation

Related questions