Exam Associate Cloud Engineer All Questions

View all questions & answers for the Associate Cloud Engineer exam

Exam Associate Cloud Engineer topic 1 question 67 discussion

Actual exam question from Google's Associate Cloud Engineer

Question #: 67
Topic #: 1

[All Associate Cloud Engineer Questions]

You built an application on Google Cloud that uses Cloud Spanner. Your support team needs to monitor the environment but should not have access to table data.
You need a streamlined solution to grant the correct permissions to your support team, and you want to follow Google-recommended practices. What should you do?

A. Add the support team group to the roles/monitoring.viewer role
B. Add the support team group to the roles/spanner.databaseUser role.
C. Add the support team group to the roles/spanner.databaseReader role.
D. Add the support team group to the roles/stackdriver.accounts.viewer role.

Show Suggested Answer

Suggested Answer: A 🗳️

by [deleted] at June 5, 2020, 2:52 p.m.

Comments

Submit Cancel

poogcp

Highly Voted 5 years ago

its A, As you need to monitor only

upvoted 47 times

WindDriver

3 years, 11 months ago

A, right, correct answer. B and C are incorrect because allow to read data. D also incorrect: Not for monitoring. roles/stackdriver.accounts.viewer Stackdriver Accounts Viewer: Read-only access to get and list information about Stackdriver account structure (resourcemanager.projects.get, resourcemanager.projects.list and stackdriver.projects.get)

upvoted 16 times

WindDriver

3 years, 11 months ago

https://cloud.google.com/iam/docs/understanding-roles

upvoted 4 times

...

Gurnoor

Highly Voted 5 years ago

A is correct as user should not have any access to data, so B and C cant be used in this scenario.

upvoted 20 times

...

nish2288

Most Recent 11 months, 4 weeks ago

Its D. Stackdriver roles in GCP (Google Cloud Platform) are predefined sets of permissions that control access to monitoring and logging data within Stackdriver, a suite of tools for monitoring and logging applications and infrastructure in GCP. These roles determine what users or groups can see and do within Stackdriver. They allow you to grant granular access levels, ensuring users have the necessary permissions to perform their tasks without exposing sensitive data or granting unnecessary control.

upvoted 1 times

peddyua

5 months ago

it does not grant access to Cloud Spanner metadata or any related Spanner-specific monitoring data.

upvoted 1 times

...

ekta25

1 year, 8 months ago

A. Add the support team group to the roles/monitoring.viewer role

upvoted 2 times

...

axantroff

1 year, 8 months ago

Selected Answer: A

Makes sense for me

upvoted 1 times

...

Captain1212

1 year, 9 months ago

Selected Answer: A

A as you only need the monitor access

upvoted 1 times

...

sakdip66

2 years, 2 months ago

the goal of support team is to MONITOR the environment only. therefore roles/monitoring.viewer role is the best option we have https://cloud.google.com/spanner/docs/iam#roles

upvoted 1 times

...

Buruguduystunstugudunstuy

2 years, 3 months ago

Selected Answer: A

Answer A, adding the support team group to the roles/monitoring.viewer role, is the CORRECT answer. This role grants read-only access to monitoring data for all resources in a project, which allows the support team to monitor the environment but not access the table data. Answer B, adding the support team group to the roles/spanner.databaseUser role, grants read and write access to all tables in the specified database, which is NOT required for the support team to monitor the environment. Answer C, adding the support team group to the roles/spanner.databaseReader role, grants read-only access to all tables in the specified database, which would give the support team access to the table data. Answer D, adding the support team group to the roles/stackdriver.accounts.viewer role, grants permissions to view Stackdriver data for all resources in a project, which is NOT directly related to monitoring the Cloud Spanner environment.

upvoted 8 times

...