Your organization operates a multi-tier microservices application across multiple Google Cloud projects and environments (e.g., production, staging). As a DevOps engineer, you need to design a centralized Cloud Monitoring dashboard that enables team members to troubleshoot across environments efficiently while maintaining strict security controls. The dashboard design must meet the following requirements: Enable engineers to dynamically filter all tiles across the dashboard by environment and resource labels without modifying underlying queries or duplicating dashboard assets. Grant an external compliance team read-only access to inspect dashboard configurations and layouts without granting them permissions to modify dashboards, create alert policies, or edit notification channels. Which configuration and IAM role assignment should you implement?

Configure `dashboardFilters` at the dashboard level targeting resource and environment labels, and assign the `roles/monitoring.dashboardViewer` role to the compliance team.: What the Solution Is This solution implements top-level dashboardFilters within the Cloud Monitoring dashboard definition and grants the predefined Monitoring Dashboard Configuration Viewer (roles/monitoring.dashboardViewer) role to the compliance auditors. How It Meets the Requirements Dynamic Multi-Resource Filtering: Defining dashboardFilters allows users to dynamically filter all charts and widgets across the dashboard using template variables and label matching (such as resource.label.environment or resource.label.zone). This eliminates the need to create separate static dashboard definitions for each environment. Least Privilege Access Control: The roles/monitoring.dashboardViewer role provides read-only permissions specifically for dashboard metadata and configuration (monitoring.dashboards.get and monitoring.dashboards.list). It deliberately restricts users from creating, updating, or deleting dashboards, alerting policies, or notification channels. Key Advantages and Capabilities Centralized Management: Allows a single unified dashboard template to serve multiple operational tiers and environments. Granular Security: Separates dashboard configuration viewing from operational management and alerting configuration. Reduced Maintenance Overhead: Avoids configuration drift caused by cloning static dashboards for each environment. Interactive Troubleshooting: Allows on-call engineers to pivot across services, clusters, and regions directly within the console UI. Why This Is Optimal Using native dashboardFilters and roles/monitoring.dashboardViewer strictly satisfies both operational agility and security governance according to Google Cloud best practices.

StudyCerts

Professional Cloud DevOps Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Cloud Monitoring Dynamic Filtering Secure Dashboard Sharing

Section: Managing dashboards (e.g., creating, filtering, sharing, playbooks, PromQL)

Your organization operates a multi-tier microservices application across multiple Google Cloud projects and environments (e.g., production, staging). As a DevOps engineer, you need to design a centralized Cloud Monitoring dashboard that enables team members to troubleshoot across environments efficiently while maintaining strict security controls.

The dashboard design must meet the following requirements:

Enable engineers to dynamically filter all tiles across the dashboard by environment and resource labels without modifying underlying queries or duplicating dashboard assets.
Grant an external compliance team read-only access to inspect dashboard configurations and layouts without granting them permissions to modify dashboards, create alert policies, or edit notification channels.

Which configuration and IAM role assignment should you implement?

Configure dashboardFilters at the dashboard level targeting resource and environment labels, and assign the roles/monitoring.dashboardViewer role to the compliance team.

Configure dashboardFilters at the dashboard level targeting resource labels, and assign the roles/monitoring.editor role with a custom IAM deny policy to the compliance team.

Create separate duplicated dashboard files for each environment, and share dashboards using unauthenticated public links.

Configure individual static query filters inside each chart tile, and assign the roles/monitoring.editor role to the compliance team.

Professional Cloud DevOps Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Cloud Monitoring Dynamic Filtering Secure Dashboard Sharing

Section: Managing dashboards (e.g., creating, filtering, sharing, playbooks, PromQL)

The dashboard design must meet the following requirements:

Enable engineers to dynamically filter all tiles across the dashboard by environment and resource labels without modifying underlying queries or duplicating dashboard assets.
Grant an external compliance team read-only access to inspect dashboard configurations and layouts without granting them permissions to modify dashboards, create alert policies, or edit notification channels.

Which configuration and IAM role assignment should you implement?

Configure dashboardFilters at the dashboard level targeting resource and environment labels, and assign the roles/monitoring.dashboardViewer role to the compliance team.

Configure dashboardFilters at the dashboard level targeting resource labels, and assign the roles/monitoring.editor role with a custom IAM deny policy to the compliance team.

Create separate duplicated dashboard files for each environment, and share dashboards using unauthenticated public links.

Configure individual static query filters inside each chart tile, and assign the roles/monitoring.editor role to the compliance team.

Explanations

What the Solution Is

This solution implements top-level dashboardFilters within the Cloud Monitoring dashboard definition and grants the predefined Monitoring Dashboard Configuration Viewer (roles/monitoring.dashboardViewer) role to the compliance auditors.

How It Meets the Requirements

Dynamic Multi-Resource Filtering: Defining dashboardFilters allows users to dynamically filter all charts and widgets across the dashboard using template variables and label matching (such as resource.label.environment or resource.label.zone). This eliminates the need to create separate static dashboard definitions for each environment.
Least Privilege Access Control: The roles/monitoring.dashboardViewer role provides read-only permissions specifically for dashboard metadata and configuration (monitoring.dashboards.get and monitoring.dashboards.list). It deliberately restricts users from creating, updating, or deleting dashboards, alerting policies, or notification channels.

Key Advantages and Capabilities

Centralized Management: Allows a single unified dashboard template to serve multiple operational tiers and environments.
Granular Security: Separates dashboard configuration viewing from operational management and alerting configuration.
Reduced Maintenance Overhead: Avoids configuration drift caused by cloning static dashboards for each environment.
Interactive Troubleshooting: Allows on-call engineers to pivot across services, clusters, and regions directly within the console UI.

Why This Is Optimal

Using native dashboardFilters and roles/monitoring.dashboardViewer strictly satisfies both operational agility and security governance according to Google Cloud best practices.

View source documentation

Professional Cloud DevOps Engineer

Cloud Monitoring Dynamic Filtering Secure Dashboard Sharing

Professional Cloud DevOps Engineer

Cloud Monitoring Dynamic Filtering Secure Dashboard Sharing

What the Solution Is

How It Meets the Requirements

Key Advantages and Capabilities

Why This Is Optimal

Related questions