You will create a new Service Account that should be able to list the Compute Engine instances in the project. You want to follow Google-recommended practices. What should you do?

Question

Options

• ACreate an Instance Template, and allow the Service Account Read Only access for the Compute
• BCreate a custom role with the permission compute.instances.list and grant the Service Account
• CGive the Service Account the role of Compute Viewer, and use the new Service Account for all
• DGive the Service Account the role of Project Viewer, and use the new Service Account for all

• A
  8% (4)
• B
  76% (37)
• C
  4% (2)
• D
  12% (6)

Explanation

Google's principle of least privilege recommends granting only the minimum permissions required for a task. To list Compute Engine instances, the only permission needed is compute.instances.list. Creating a custom role with exactly that permission and assigning it to the Service Account is the most restrictive, correct approach. Option C (Compute Viewer) grants read access to all Compute Engine resources, which is broader than necessary. Option D (Project Viewer) is far too broad, granting read access across all project resources. Option A (Instance Template) is unrelated to the access control requirement.

No community discussion yet for this question.