Exam Associate Cloud Engineer All Questions

View all questions & answers for the Associate Cloud Engineer exam

Exam Associate Cloud Engineer topic 1 question 116 discussion

Actual exam question from Google's Associate Cloud Engineer

Question #: 116
Topic #: 1

[All Associate Cloud Engineer Questions]

You are configuring service accounts for an application that spans multiple projects. Virtual machines (VMs) running in the web-applications project need access to BigQuery datasets in crm-databases-proj. You want to follow Google-recommended practices to give access to the service account in the web-applications project. What should you do?

A. Give ג€project ownerג€ for web-applications appropriate roles to crm-databases-proj.
B. Give ג€project ownerג€ role to crm-databases-proj and the web-applications project.
C. Give ג€project ownerג€ role to crm-databases-proj and bigquery.dataViewer role to web-applications.
D. Give bigquery.dataViewer role to crm-databases-proj and appropriate roles to web-applications.

Show Suggested Answer

Suggested Answer: D 🗳️

by DarioFama23 at July 7, 2020, 4:05 p.m.

Comments

Submit Cancel

ezat

Highly Voted 5 years ago

D cuz u just need read for DB at the other project

upvoted 31 times

DarioFama23

5 years ago

U re right, D is the correct answee

upvoted 4 times

...

tavva_prudhvi

4 years, 3 months ago

See the option correctly, as the web app needs access to the big query datasets we have to give access to the web app the data viewer role to only read the datasets! Hence, C

upvoted 6 times

...

[Removed]

4 years, 7 months ago

Question didn't specify if the required access is Read only or more, its saying "access" which could be write permissions as well. I will go with C

upvoted 2 times

dttncl

3 years, 9 months ago

It is D because you're right, the question doesn't specify any specific kind of access, however, we need to follow the principle of least-privilege. Hence, we can only assume that read-only access is needed. bigquery.dataViewer should be assigned to the group of analysts in the crm-databases-proj project. https://cloud.google.com/bigquery/docs/access-control-examples#read_access_to_data_in_a_different_project

upvoted 10 times

...

[Removed]

4 years, 7 months ago

U r right, it D. why to give "project owner" as stated on C. correct answer is D

upvoted 6 times

GCPACE2020

4 years, 1 month ago

but why giving bigquery.dataViewer to crm-databases-proj. we should give for web-application.

upvoted 9 times

S_marquez

3 years, 4 months ago

You can technically give bigquery.dataviewer to crm-databases-proj service account then create a Key and use that key on the VMs, there for making it correct to use D as answer but is way to dumb I would prefer C BUUUUUUT WHY would I give Project Owner to crm-databases-proj? they really do not evaluate your knowladge

upvoted 3 times

...

DarioFama23

Highly Voted 5 years ago

C is correct..

upvoted 11 times

BigQuery

3 years, 4 months ago

THAT SO DUM

upvoted 5 times

Romio2023

1 year, 7 months ago

I meet BigQuery the first time ever personly

upvoted 2 times

...

GCPACE2020

4 years, 1 month ago

But why giving project owner role to crm-databases-proj ?

upvoted 3 times

...

jlocke

Most Recent 5 months, 2 weeks ago

Selected Answer: D

Here’s how to interpret the wording: "Give bigquery.dataViewer role to crm-databases-proj" means that you update the IAM policy for the crm-databases-proj project (or specifically the BigQuery datasets within that project) so that the service account (which is part of the web-applications project) gets the BigQuery Data Viewer role.

upvoted 1 times

...

Izzy55555

5 months, 3 weeks ago

Selected Answer: C

I find this question confusing, in Google Cloud IAM, roles are granted to members, not directly to projects. Why are all the options to give roles to projects?

upvoted 1 times

...

guidbem

9 months, 3 weeks ago

It is D. Tested and approved that you do not need BigQuery permissions on the web-app project to access data on the bq tables stored in the crm-dbs project. You do need bq permissions for the SA on the crm project and compute permissions for the same SA on the web-app project. Then, using this SA on a VM on the web-app server, you can access data from bq on the crm-dbs project

upvoted 2 times

...

Namik

11 months, 2 weeks ago

Selected Answer: C

Explanation: Least Privilege Principle: This approach adheres to the principle of least privilege by granting the minimum necessary permissions. Project Owner: The crm-databases-proj project needs full control to manage its resources. bigquery.dataViewer: The web-applications project only needs read access to BigQuery datasets in the crm-databases-proj project. Why other options are less suitable: A: Giving project owner to web-applications provides unnecessary permissions. B: Giving project owner to both projects grants excessive permissions. D: Giving bigquery.dataViewer to crm-databases-proj is incorrect as this project needs full control over its resources. By following option C, you ensure that the web-applications project has the required access to BigQuery datasets without compromising security.

upvoted 2 times

...

nish2288

1 year, 1 month ago

Selected Answer: D

Let's analyze the options: A & B: Granting "project owner" gives excessive permissions, violating the least privilege principle. C: Granting "project owner" to crm-databases-proj is unnecessary. D: Granting "bigquery.dataViewer" to crm-databases-proj allows the VM access to datasets and aligns with least privilege. Granting appropriate roles to web-applications secures the web application itself (not shown in this scenario). Therefore, option D is the recommended approach.

upvoted 1 times

...

abhi2704

1 year, 5 months ago

Project owner role is not required here, so that leaves us with only Option D

upvoted 2 times

...

Bagibo

1 year, 7 months ago

Selected Answer: D

A, b & c is wrong. Keywords is configuring aervice account. A,b & c concerns user account. Correct answer is D

upvoted 1 times

...

Cynthia2023

1 year, 7 months ago

None of the options is correct. As for D: This option is unclear and potentially misleading. The bigquery.dataViewer role should be assigned specifically to the service account in the web-applications project, not to the crm-databases-proj project.

upvoted 3 times

Cynthia2023

1 year, 7 months ago

The ideal approach (not listed in the options) would be: Create a service account in the web-applications project specifically for accessing the BigQuery datasets. Grant this service account the bigquery.dataViewer role (or another more specific role if different access is needed) on the crm-databases-proj project's BigQuery datasets. Use this service account in your VMs in the web-applications project.

upvoted 2 times

...

thewalker

1 year, 8 months ago

Damn! All the four options are correct :-D for the question given :-)

upvoted 2 times

...

BAofBK

1 year, 9 months ago

The correct answer is C

upvoted 1 times

...

Captain1212

1 year, 11 months ago

Selected Answer: D

D is the correct answer, because all other option giveing access to project owner

upvoted 1 times

...

SanjeevKumar1983

1 year, 11 months ago

Corrct Answer is D. Lets just read the options D this way, then it makes sense Give service account the bigquery.dataViewer role to crm-databases-proj and service account the appropriate roles to web-applications.

upvoted 2 times

...

Ahmed_Y

1 year, 11 months ago

Selected Answer: D

Thanks guys for making that clear for me. Now simply guys, among all the answers, D is giving to the web-application proj the appropriate role, while giving the crm-databases-proj the least privilege role.

upvoted 1 times

...

Nxt_007

1 year, 12 months ago

Selected Answer: D

Correct answer is D As basic roles (including Owner) should not be used in production environment:

upvoted 1 times

...

yichuan

2 years ago

Selected Answer: C

C is correct..

upvoted 1 times

...

Load full discussion...