A company hired a consultant to diagnose and report performance issues of an application hosted on an IaaS, three-tier application. The cloud administrator must provision only the access required by t

Read/write access to the load balancer configuration is generally not needed to diagnose application performance issues, as these issues are more often related to the backend servers or application code. Modifying load balancer settings could also disrupt production traffic.

An administrator account on all resources in a region provides excessive permissions far beyond what is needed for diagnosing application performance, violating the principle of least privilege.

Granting read/write access to cloud compute resources allows the consultant to start, stop, restart, or potentially modify configuration parameters of virtual machines (e.g., CPU, RAM, disk) to troubleshoot performance, which is crucial for IaaS application diagnosis.

While server OS logs are useful, "Read-only access to the server OS logs" is too specific and typically less comprehensive than cloud-level diagnostic logs which aggregate metrics and logs from various resources. Cloud diagnostic logs (E) are broader and often preferred for cloud infrastructure.

Read-only access to cloud resource diagnostic logs (e.g., Azure Monitor logs, AWS CloudWatch logs) provides essential data on resource utilization, errors, and performance metrics without allowing changes to the environment. This helps pinpoint performance bottlenecks at the infrastructure level.

An administrator account in the server OS grants full control over the operating system, which is excessive for diagnosing performance issues and violates the principle of least privilege. This level of access is rarely granted to external consultants unless absolutely necessary for deep-level OS debugging.