You are adding steps to a working automation that uses a service account to authenticate. You need to drive the automation the ability to retrieve files from a Cloud Storage bucket. Your…

Question

Options

• AGrant the compute.instanceAdmin to your user account.
• BGrant the iam.serviceAccountUser to your user account.
• CGrant the read-only privilege to the service account for the Cloud Storage bucket.
• DGrant the cloud-platform privilege to the service account for the Cloud Storage bucket.

• A
  2% (1)
• B
  9% (4)
• C
  84% (36)
• D
  5% (2)

Explanation

The principle of least privilege requires granting only the permissions needed for the task. The automation only needs to retrieve (read) files from a specific Cloud Storage bucket, so the service account should receive the storage.objectViewer or equivalent read-only role scoped to that bucket. Option C correctly grants read-only access to the service account at the bucket level. Option D (cloud-platform) grants broad access to virtually all GCP services - far more than necessary and a security risk. Options A and B grant roles to a user account rather than the service account that performs the automation, which is both architecturally wrong and irrelevant to the task.

No community discussion yet for this question.