nerdexam
Google

PROFESSIONAL-CLOUD-SECURITY-ENGINEER · Question #321

Your organization is implementing separation of duties in a Google Cloud project. A group of developers must deploy new code, but cannot have permission to change network firewall rules. What should…

The correct answer is C. Create and assign two custom IAM roles. Assign the deployer role to control Compute Engine. To implement separation of duties where developers can deploy code but not modify firewall rules, create and assign custom IAM roles that grant only the necessary permissions.

Submitted by saadiq_pk· Apr 18, 2026Configuring access within a cloud solution environment

Question

Your organization is implementing separation of duties in a Google Cloud project. A group of developers must deploy new code, but cannot have permission to change network firewall rules. What should you do?

Options

  • AAssign the network administrator IAM role to all developers. Tell developers not to change firewall
  • BUse Access Context Manager to create conditions that allow only authorized administrators to
  • CCreate and assign two custom IAM roles. Assign the deployer role to control Compute Engine
  • DGrant the editor IAM role to the developer group. Explicitly negate any firewall modification

How the community answered

(54 responses)
  • A
    6% (3)
  • B
    4% (2)
  • C
    80% (43)
  • D
    11% (6)

Why each option

To implement separation of duties where developers can deploy code but not modify firewall rules, create and assign custom IAM roles that grant only the necessary permissions.

AAssign the network administrator IAM role to all developers. Tell developers not to change firewall

The Network Administrator role grants extensive permissions, including the ability to manage firewall rules, which directly violates the requirement that developers cannot change them.

BUse Access Context Manager to create conditions that allow only authorized administrators to

Access Context Manager is used for fine-grained access control based on context (e.g., IP address, device compliance), not for defining or modifying the base permissions granted by IAM roles to enforce separation of duties.

CCreate and assign two custom IAM roles. Assign the deployer role to control Compute EngineCorrect

Creating custom IAM roles allows for precise permission definitions, granting a deployer role for Compute Engine operations while withholding permissions for network firewall rule modifications. This adheres to the principle of least privilege and ensures developers only have access to perform their specific tasks without unauthorized network changes.

DGrant the editor IAM role to the developer group. Explicitly negate any firewall modification

The Editor role is broad and includes permissions to manage resources, including network configurations and firewall rules; explicitly negating permissions is not a standard or efficient practice in Google Cloud IAM and can lead to complex, unmanageable policies.

Concept tested: Custom IAM roles for granular permissions

Source: https://cloud.google.com/iam/docs/understanding-custom-roles

Topics

#IAM#Custom Roles#Separation of Duties#Least Privilege

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice