nerdexam
Google

PROFESSIONAL-CLOUD-ARCHITECT · Question #362

Your company has hired an external auditing firm to perform a compliance audit. Your company's governance policy requires that external auditors be managed in a single Google Group that is granted…

The correct answer is A. Apply an IAM policy binding that grants the roles/storage.objectViewer role to the Google Group. Granting the Google Group read-only access with a time-based IAM Condition enforces least privilege automatically for the exact audit window without needing manual add/remove actions. Because access is granted through individual user identities in the group, Cloud Audit Logs…

Submitted by ngozi_ng· Mar 30, 2026Designing for security and compliance

Question

Your company has hired an external auditing firm to perform a compliance audit. Your company's governance policy requires that external auditors be managed in a single Google Group that is granted temporary, read-only access to a Cloud Storage bucket named audit-evidence-bucket. Access must be traceable to the individual auditor's identity and be active only for the duration of the audit engagement, which runs the entire month of October. You need a secure access control strategy that avoids administrative overhead and complies with your company's governance policy. What should you do?

Options

  • AApply an IAM policy binding that grants the roles/storage.objectViewer role to the Google Group.
  • BCreate a service account, and grant it the roles/storage.objectViewer role on the bucket.
  • CUse Cloud Scheduler to run a Cloud Run functions script that adds the IAM binding of
  • DUse Workforce Identity Federation to map the auditors' group to the Google Group. Bind the

How the community answered

(31 responses)
  • A
    77% (24)
  • B
    13% (4)
  • C
    3% (1)
  • D
    6% (2)

Explanation

Granting the Google Group read-only access with a time-based IAM Condition enforces least privilege automatically for the exact audit window without needing manual add/remove actions. Because access is granted through individual user identities in the group, Cloud Audit Logs attribute activity to each auditor, satisfying traceability while minimizing administrative overhead.

Topics

#IAM policy binding#Google Groups#temporary access#least privilege

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PROFESSIONAL-CLOUD-ARCHITECT Practice