An enterprise manages multiple database workloads across several projects located inside a single folder named Application-Services. The security team needs to grant members of the database administration team permissions to inspect and configure Cloud SQL instances across all current and future projects in this folder. The access control architecture must satisfy the following constraints: Administrators must be able to view instance configuration details and navigate Cloud SQL resources seamlessly within the Google Cloud console. Administrators must NOT have permission to delete instances, delete databases, or modify IAM policy bindings. Administrators must NOT receive read or write permissions to any non-database services in the projects. What should the security engineer do to enforce the principle of least privilege?

Create a custom IAM role at the folder level that includes the required Cloud SQL permissions—including both `cloudsql.instances.get` and `cloudsql.instances.list`—and bind this role to the database administration group on the `Application-Services` folder.: What Custom IAM Roles at the Folder Level Are IAM Custom Roles allow security administrators to bundle granular, discrete permissions tailored specifically to workload responsibilities when predefined or basic roles do not meet the principle of least privilege. Defining custom roles at the folder level ensures that the role definition is inherited and available across all underlying descendant projects within that branch of the resource hierarchy. How It Meets the Requirements Precise least-privilege scoping: Including only specific Cloud SQL permissions ensures administrators cannot execute privileged actions such as deleting databases, managing SSL certificates, or calling cloudsql.instances.delete. Console navigation and functionality: When authoring custom roles for Cloud SQL, including both cloudsql.instances.get and cloudsql.instances.list satisfies the prerequisite console dependency, allowing users to view and select instances in the Google Cloud console UI without error. Restricting non-database services: By defining a custom role with service-specific permissions, the role eliminates unwanted read or write access across other Google Cloud products such as Compute Engine, BigQuery, or Cloud Storage. Centralized folder inheritance: Binding the role to the database administration group at the Application-Services folder enforces policy consistency across all existing and newly created descendant projects automatically. Key Advantages Eliminates administrative bloat: Protects projects from unintentional privilege creep associated with broader predefined roles. Avoids permission duplication: Defining the role once at the folder resource avoids redundant role definitions across multiple individual projects. Enforces separation of duties: Prevents operators from executing unauthorized IAM policy modifications (setIamPolicy). Why This Is Optimal Creating a targeted custom role at the folder hierarchy level directly achieves the balance between administrative functionality and strict least-privilege governance.

Custom Iam Role Cloudsql Folder Least Privilege | Professional Cloud Security Engineer

AdvancedProfessional Cloud Security Engineer

An enterprise organizes its Google Cloud resources under an Engineering parent folder, which contains two subfolders: Development and Production. A security auditor discovers that the group dev-team@example.com is currently bound to the Compute Instance Admin role (roles/compute.instanceAdmin) directly on the Engineering folder. The security team must enforce the following access requirements: Developers must retain full administrative control over Compute Engine instances within projects located in the Development folder. Developers must be restricted to read-only access (roles/compute.viewer) for Compute Engine instances within projects located in the Production folder. Which architectural change should the security team implement to satisfy these access requirements?

Defining access control at the organization, folder, project, and resource level using the principle of least privilege.

AdvancedProfessional Cloud Security Engineer

An enterprise organization is refining access controls to comply with the principle of least privilege across its development environments. The security team needs to grant an operational group the Compute Instance Admin role (roles/compute.instanceAdmin.v1) on a folder containing multiple projects. The access policy must meet the following constraints: Permissions must only apply to Compute Engine VM instances that possess the environment: development Resource Manager tag (either directly attached or inherited). To mitigate security risks, the IAM condition must prevent unintentional permission grants if the tag key or tag value is deleted and subsequently recreated with identical short names but intended for different scopes. Which IAM condition expression should the security engineer attach to the role binding?

Defining access control at the organization, folder, project, and resource level using the principle of least privilege.

AdvancedProfessional Cloud Security Engineer

An enterprise organization is establishing baseline authentication security controls across its Cloud Identity and Google Cloud environment. The security engineering team needs to enforce hardened authentication and recovery policies for privileged accounts (super administrators) while maintaining standard policies for general workforce users. Specifically, the implementation must achieve the following requirements: Super administrator identities must be isolated to apply targeted authentication policies. Privileged accounts must be protected against phishing attacks by enforcing hardware-backed 2-Step Verification (2SV). Privileged accounts must prevent unauthorized access through self-service recovery bypasses. Which configuration strategy should the security engineer implement in the Google Admin console?

Creating a password and session management policy for user accounts.

AdvancedProfessional Cloud Security Engineer

An enterprise has enabled Cloud Next Generation Firewall (Cloud NGFW) Enterprise with Intrusion Detection and Prevention Service (IDPS) in a global network firewall policy. A security engineer is investigating a potential command-and-control communication attempt targeting an internal Compute Engine workload. The engineer needs to query Cloud Logging to locate the Layer 7 threat detection record generated by the firewall endpoint and correlate it with the firewall policy rule execution. Which query strategy and log structure should the security engineer use in Cloud Logging to analyze both events?

Configuring and analyzing network logs (Cloud Next Generation Firewall [Cloud NGFW], VPC flow logs, Packet Mirroring, Cloud Intrusion Detection System [Cloud IDS], Log Analytics).

AdvancedProfessional Cloud Security Engineer

An organization is designing an automated identity synchronization architecture between their on-premises Active Directory Domain Services (AD DS) forest and Cloud Identity to enable workforce access to Google Cloud resources. The security team establishes the following requirements: User lifecycle management (creation, updates, suspensions) must be automated from AD DS to Cloud Identity without synchronizing user password hashes to Google Cloud. If the on-premises identity federation service experiences an outage or misconfiguration, administrators must still be able to re-authorize and manage the directory synchronization tool. The directory synchronization service account in Cloud Identity must follow isolation best practices and be protected against authentication lockouts. Which architectural and configuration approach should the organization implement?

Configuring Google Cloud Directory Sync and implement single sign-on (SSO) with a third-party identity provider.

AdvancedProfessional Cloud DevOps Engineer

Your enterprise is establishing an artifact management architecture across Google Cloud CI/CD pipelines for Maven and npm workloads. The architecture must satisfy several key requirements: Internal Artifact Storage: Proprietary libraries built by internal teams must be securely published and stored. Public Dependency Caching: Builds must pull open-source dependencies (such as Maven Central and npmjs) through a local cache to reduce latency, decrease external data transfer costs, and maintain build availability during upstream outages. Supply Chain Security: The architecture must protect developers and CI/CD pipelines from dependency confusion attacks where malicious public packages mimic internal package names. Simplified Client Configuration: Client build tools (pom.xml / settings.xml and .npmrc) must query a single endpoint per format rather than managing multiple repository endpoints. Which Artifact Registry repository architecture should you establish?

Artifact Registry configuration

Professional Cloud Security Engineer

Custom Iam Role Cloudsql Folder Least Privilege

Related questions

Professional Cloud Security Engineer

Custom Iam Role Cloudsql Folder Least Privilege

What Custom IAM Roles at the Folder Level Are

How It Meets the Requirements

Key Advantages

Why This Is Optimal

Related questions

What Custom IAM Roles at the Folder Level Are

How It Meets the Requirements

Key Advantages

Why This Is Optimal