Professional Cloud Security Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
An enterprise security team is reviewing access controls across production Google Cloud projects. The Database Operations group (dba-team@example.com) currently holds the predefined roles/cloudsql.admin role. An IAM evaluation and recommender analysis reveal that this group only requires read-only visibility into database configurations via the Google Cloud console, along with the ability to view Cloud SQL security insights and recommendations.
To adhere to the principle of least privilege while ensuring the Google Cloud console functions properly, which action should the security engineer take?
Grant the predefined roles/cloudsql.viewer role and the roles/recommender.iamAdmin role directly to individual user accounts within the database operations team.
Grant the basic roles/viewer role to the dba-team@example.com group at the organization level.
Create a custom IAM role that contains both cloudsql.instances.list and cloudsql.instances.get permissions alongside recommender.cloudsqlInstanceSecurity permissions, and bind the role to the dba-team@example.com group.
Create a custom IAM role that includes only the cloudsql.instances.list and recommender.iamPolicyRecommendations.list permissions, and bind it to the dba-team@example.com group.
Grant the predefined roles/cloudsql.viewer role and the roles/recommender.iamAdmin role directly to individual user accounts within the database operations team.
Grant the basic roles/viewer role to the dba-team@example.com group at the organization level.
Create a custom IAM role that contains both cloudsql.instances.list and cloudsql.instances.get permissions alongside recommender.cloudsqlInstanceSecurity permissions, and bind the role to the dba-team@example.com group.
Custom IAM roles allow organizations to group user-defined collections of granular permissions that tailor access precisely to operational requirements when predefined roles grant excess privileges.
StudyCerts
StudyCertsroles/cloudsql.admin grants, providing only read and security-recommender permissions.cloudsql.instances.list and cloudsql.instances.get must be included in custom roles; otherwise, navigation fails.recommender.cloudsqlInstanceSecurityInsights.get, recommender.cloudsqlInstanceSecurityInsights.list, recommender.cloudsqlInstanceSecurityRecommendations.get, and recommender.cloudsqlInstanceSecurityRecommendations.list enables the group to assess security vulnerabilities without unnecessary management permissions.dba-team@example.com enforces consistent authorization across all database team members through identity federation or Cloud Identity.Creating a tailored custom role containing the necessary instance read and recommender permissions—while adhering to the list and get pairing requirement—strictly fulfills least privilege without disrupting day-to-day administrative visibility.
Create a custom IAM role that includes only the cloudsql.instances.list and recommender.iamPolicyRecommendations.list permissions, and bind it to the dba-team@example.com group.