Your organization uses the top-tier folder to separate application environments (prod and dev). The developers need to see all application development audit logs, but they are not permitted to…

Question

Options

• A
  1. Grant logging.viewer role to the security team at the organization resource level.
• B
  1. Grant logging.viewer role to the security team at the organization resource level.
• C
  1. Grant logging.admin role to the security team at the organization resource level.
• D
  1. Grant logging.admin role to the security team at the organization resource level.

• A
  73% (24)
• B
  18% (6)
• C
  3% (1)
• D
  6% (2)

Explanation

This question tests understanding of IAM inheritance and least privilege. The correct approach is: (1) Grant the 'logging.viewer' role to the security team at the organization level, so they inherit access to logs in all folders (prod and dev). (2) Grant the 'logging.viewer' role to developers at the dev folder level only, so they can see dev logs but not prod logs. This follows least privilege because developers receive the minimum necessary access (dev folder only), and the security team gets broad access via inheritance. Options C and D use 'logging.admin', which grants excessive permissions - admin rights are not needed just to view logs. Option B likely reverses the resource levels or grants incorrect roles.

No community discussion yet for this question.