The government has ordered an audit of your company's data. You have hired an external company to conduct the audit. They need to be able to review the data stored in your Cloud Storage buckets…

Question

Options

• AGive the auditors an Owner role on the eight buckets so that they have proper access.
• BGive them Storage Object Viewer access to the buckets in those eight projects.
• CThey might need access to all projects as the audit progresses; so give them access to all
• DThey might need access to all projects as the audit progresses; so give them the Editor role on all

• A
  7% (4)
• B
  74% (43)
• C
  16% (9)
• D
  3% (2)

Explanation

This question tests the principle of least privilege, a foundational IAM security best practice. Auditors need read-only access to review data - the Storage Object Viewer role grants exactly that (list and read objects) without allowing any modifications or deletions. Option A (Owner role) is far too permissive - it grants full control including the ability to delete resources, which is unnecessary and dangerous. Option C (access to all projects) violates least privilege by expanding scope beyond the eight relevant projects. Option D (Editor role on all projects) is similarly over-privileged, granting write access across the entire organization when only read access to specific buckets is needed. Always grant the minimum permissions necessary for the task.

No community discussion yet for this question.