Exam Associate Cloud Engineer All Questions

View all questions & answers for the Associate Cloud Engineer exam

Exam Associate Cloud Engineer topic 1 question 261 discussion

Actual exam question from Google's Associate Cloud Engineer

Question #: 261
Topic #: 1

[All Associate Cloud Engineer Questions]

You are in charge of provisioning access for all Google Cloud users in your organization. Your company recently acquired a startup company that has their own Google Cloud organization. You need to ensure that your Site Reliability Engineers (SREs) have the same project permissions in the startup company's organization as in your own organization. What should you do?

A. In the Google Cloud console for your organization, select Create role from selection, and choose destination as the startup company's organization.
B. In the Google Cloud console for the startup company, select Create role from selection and choose source as the startup company's Google Cloud organization.
C. Use the gcloud iam roles copy command, and provide the Organization ID of the startup company's Google Cloud Organization as the destination.
D. Use the gcloud iam roles copy command, and provide the project IDs of all projects in the startup company's organization as the destination.

Show Suggested Answer

Suggested Answer: C 🗳️

by shiowbah at Dec. 30, 2023, 6:58 a.m.

Comments

Submit Cancel

halifax

5 months, 3 weeks ago

If the correct answer is C ? How do you do it on the 'gcloud cli' command? I only know how to do it using project ID - can you do it using org ID? gcloud iam roles copy \ --source="roles/<source_role_id>" \ --destination=<destination_role_name> \ --dest-project=<destination_project_id> I think, the 'gcloud cli ' command only copies roles from one organization to another within Google Cloud using project ID, not org ID!

upvoted 1 times

...

yomi95

8 months, 1 week ago

I'm confused between C and D, both use "gcloud iam roles copy" which is required for this scenario, but most voted answer is C while I'm unsure why giving project level permission is incorrect. According to lease privilege SRE should be okay to get permission project by project which is a hassle than C but it is not incorrect and can be done. Anyone pls correct me or give a link to an official document.

upvoted 1 times

yomi95

8 months, 1 week ago

According to Gemini (Couldn't find official source) below is correct which means D is also possible answer. in the question is does not say fewest steps or best practice method. gcloud iam roles copy --source-organization=organizations/123456789 --destination-projects=projects/project1,projects/project2,projects/project3 --role-ids=roles/compute.admin,roles/storage.objectViewer

upvoted 2 times

denno22

8 months, 1 week ago

We could have a large number of projects, so copying by project may not be practical. Therefore copying by organisation is fewest steps. Also just copying to all projects gives the same result as copying by organisation, but involves more steps.

upvoted 1 times

...

Cristianssenn

1 year ago

The keys in question are SRE and project permissions. Choosing C will copy all your organization IAM permissions and not the only ones defined for SRE at project level. So, the correct answer is D.

upvoted 1 times

iooj

9 months, 1 week ago

--dest-project=DEST_PROJECT - the project of the destination role. We cannot specify all projects. So, I think that's the trick here.

upvoted 2 times

...

Matheus_1346

1 year, 1 month ago

Selected Answer: C

The correct one is C

upvoted 1 times

...

PiperMe

1 year, 3 months ago

Selected Answer: C

C. The gcloud iam roles copy command is designed specifically for copying IAM roles between different resources, including organizations.

upvoted 4 times

...

KelvinToo

1 year, 5 months ago

Selected Answer: C

Per ChatGPT, Option C is the correct choice for achieving consistency in project permissions across both organizations by leveraging the gcloud iam roles copy command and providing the Organization ID of the startup company's Google Cloud Organization as the destination.

upvoted 2 times

...

shiowbah

1 year, 5 months ago

C. Use the gcloud iam roles copy command, and provide the Organization ID of the startup company's Google Cloud Organization as the destination.

upvoted 2 times

...