Design for Security — GCP PCA Practice Question 26

How to approach this question

When predefined roles are too broad or too narrow, use Custom Roles to achieve exact least privilege.

Full Answer

C.Create a Custom IAM Role with the specific permissions required and assign it to the developer group at the Folder or Project level.✓ Correct

Google Cloud provides hundreds of predefined IAM roles, but sometimes a specific job function requires a unique combination of permissions. By creating a Custom IAM Role, you can select the exact API permissions needed (e.g., compute.instances.get, compute.instances.start, compute.instances.stop, storage.buckets.get) without granting destructive permissions like compute.instances.delete.

Common mistakes

Using primitive roles (Owner, Editor, Viewer) is a major anti-pattern in GCP enterprise environments.

How to approach this question

Full Answer

Common mistakes

Practice the full GCP Professional Cloud Architect Practice Exam 7

More questions from this exam