An enterprise is reviewing the security posture of an analytics environment in Google Cloud. Several data engineers currently have the primitive roles/editor role granted at the project level, which grants overly broad permissions across Google Cloud services such as Cloud Bigtable and BigQuery. You have the following operational and security requirements: Enforce the principle of least privilege by removing unnecessary permissions based on observed activity. Use automated intelligence to identify actual permission usage over time. Minimize administrative maintenance overhead when Google Cloud introduces new service-level API capabilities. Which strategy should you implement?

Review and apply role recommendations provided by IAM Recommender to replace the primitive role with appropriate predefined roles.: What IAM Recommender and Predefined Roles Are IAM Recommender utilizes machine learning and historical audit logging to analyze permission usage patterns over a rolling 90-day window. It automatically identifies discrepancies between the permissions granted to a principal and the permissions actually exercised, generating actionable recommendations to replace overly permissive roles. Predefined roles are curated and maintained directly by Google Cloud. They group permissions tailored to specific job functions (e.g., roles/bigtable.user or roles/bigquery.user) and are automatically updated by Google when new API methods and features are added to that service. How it Meets All Requirements Enforcing Least Privilege: IAM Recommender identifies unused permissions within the broad roles/editor primitive role and recommends tighter predefined roles matching the engineers' actual tasks. Automated Usage Analysis: It continuously evaluates telemetry and access logs to provide data-driven recommendations without requiring manual audit log scraping. Low Maintenance Overhead: Predefined roles are automatically updated with new feature permissions as Google Cloud services evolve, avoiding the ongoing maintenance overhead inherent to custom roles. Key Advantages Automated Risk Reduction: Instantly flags high-risk permissions and excessive basic access. Managed Definitions: Eliminates manual maintenance of permission lists. Contextual Insights: Provides concrete justification and impact analysis before changes are applied. Scalable Governance: Easily integrated into automated CI/CD security remediation pipelines. Why This Is Optimal Primitive roles (roles/owner, roles/editor, roles/viewer) grant broad access across almost every resource in a project and violate the principle of least privilege. Replacing them with Google-managed predefined roles suggested by IAM Recommender gives precise access while ensuring zero maintenance overhead when APIs change.

StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Iam Role Differentiation Least Privilege Recommender

Section: Identity and Access Management (IAM)

An enterprise is reviewing the security posture of an analytics environment in Google Cloud. Several data engineers currently have the primitive roles/editor role granted at the project level, which grants overly broad permissions across Google Cloud services such as Cloud Bigtable and BigQuery.

You have the following operational and security requirements:

Enforce the principle of least privilege by removing unnecessary permissions based on observed activity.
Use automated intelligence to identify actual permission usage over time.
Minimize administrative maintenance overhead when Google Cloud introduces new service-level API capabilities.

Which strategy should you implement?

Demote the engineers to the primitive roles/viewer role and grant them roles/owner temporarily using elevated access workflows when writes are required.

Review and apply role recommendations provided by IAM Recommender to replace the primitive role with appropriate predefined roles.

Create a project-level custom IAM role containing only the exact permissions observed during manual log review, and assign it to the engineers.

Grant service agent roles directly to the data engineers for each service they interact with in the project.

Professional Cloud Architect

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Iam Role Differentiation Least Privilege Recommender

Section: Identity and Access Management (IAM)

You have the following operational and security requirements:

Enforce the principle of least privilege by removing unnecessary permissions based on observed activity.
Use automated intelligence to identify actual permission usage over time.
Minimize administrative maintenance overhead when Google Cloud introduces new service-level API capabilities.

Which strategy should you implement?

Demote the engineers to the primitive roles/viewer role and grant them roles/owner temporarily using elevated access workflows when writes are required.

Review and apply role recommendations provided by IAM Recommender to replace the primitive role with appropriate predefined roles.

Create a project-level custom IAM role containing only the exact permissions observed during manual log review, and assign it to the engineers.

Grant service agent roles directly to the data engineers for each service they interact with in the project.

Explanations

What IAM Recommender and Predefined Roles Are

IAM Recommender utilizes machine learning and historical audit logging to analyze permission usage patterns over a rolling 90-day window. It automatically identifies discrepancies between the permissions granted to a principal and the permissions actually exercised, generating actionable recommendations to replace overly permissive roles.

Predefined roles are curated and maintained directly by Google Cloud. They group permissions tailored to specific job functions (e.g., roles/bigtable.user or roles/bigquery.user) and are automatically updated by Google when new API methods and features are added to that service.

How it Meets All Requirements

Enforcing Least Privilege: IAM Recommender identifies unused permissions within the broad roles/editor primitive role and recommends tighter predefined roles matching the engineers' actual tasks.
Automated Usage Analysis: It continuously evaluates telemetry and access logs to provide data-driven recommendations without requiring manual audit log scraping.
Low Maintenance Overhead: Predefined roles are automatically updated with new feature permissions as Google Cloud services evolve, avoiding the ongoing maintenance overhead inherent to custom roles.

Key Advantages

Automated Risk Reduction: Instantly flags high-risk permissions and excessive basic access.
Managed Definitions: Eliminates manual maintenance of permission lists.
Contextual Insights: Provides concrete justification and impact analysis before changes are applied.
Scalable Governance: Easily integrated into automated CI/CD security remediation pipelines.

Why This Is Optimal

Primitive roles (roles/owner, roles/editor, roles/viewer) grant broad access across almost every resource in a project and violate the principle of least privilege. Replacing them with Google-managed predefined roles suggested by IAM Recommender gives precise access while ensuring zero maintenance overhead when APIs change.

View source documentation

Professional Cloud Architect

Iam Role Differentiation Least Privilege Recommender

Professional Cloud Architect

Iam Role Differentiation Least Privilege Recommender

What IAM Recommender and Predefined Roles Are

How it Meets All Requirements

Key Advantages

Why This Is Optimal

Related questions