Exam Professional Cloud Database Engineer topic 1 question 90 discussion

Actual exam question from Google's Professional Cloud Database Engineer

Question #: 90
Topic #: 1

[All Professional Cloud Database Engineer Questions]

You are a DBA on a Cloud Spanner instance with multiple databases. You need to assign these privileges to all members of the application development team on a specific database:

Can read tables, views, and DDL -

Can write rows to the tables -

Can add columns and indexes -

Cannot drop the database -
What should you do?

A. Assign the Cloud Spanner Database Reader and Cloud Spanner Backup Writer roles.
B. Assign the Cloud Spanner Database Admin role.
C. Assign the Cloud Spanner Database User role.
D. Assign the Cloud Spanner Admin role.

Show Suggested Answer

Suggested Answer: C 🗳️

by pk349 at Dec. 24, 2022, 11:34 p.m.

Comments

Submit Cancel

whoosh

1 year, 1 month ago

Selected Answer: C

Option C is corect spanner.admin God-tier control over everything Full CRUD & DDL for instances, databases, users, policies Manage entire Cloud Spanner environment spanner.databaseAdmin Database master control Full CRUD & DDL for databases, users, policies Create, manage, and secure databases spanner.databaseUser Power user with data rights Full CRUD & DDL for specified databases Read, write, modify data, manage database schema spanner.databaseReader Curious but hands-off observer Read-only access and query execution Analyze data without manipulation spanner.viewer Peeping Tom (metaphorically speaking) View instances, databases, and users Monitor Cloud Spanner metadata, no data access spanner.backupAdmin Backup whiz Create, view, update, delete backups Manage backups without accessing data

upvoted 2 times

...

learnazureportal

1 year, 5 months ago

The answer list is not correct. we need to have a custom role for this task. BTW, Option C (assigning the Cloud Spanner Database User role) does not provide the necessary permissions to add columns and indexes or perform DDL operations. that said, it not correct either :)

upvoted 1 times

...

dynamic_dba

1 year, 11 months ago

C. This has nothing to do with backups. Eliminate A. Any admin role would be too wide. Eliminate B and D. That leaves C. roles/spanner.databaseUser provides r/w. view and update schemas. https://cloud.google.com/spanner/docs/iam#spanner.databaseUser

upvoted 3 times

...

zanhsieh

2 years ago

Selected Answer: C

C A: WRONG. Neither roles can add columns and indexes (missing spanner.databases.updateDdl permission) B: WRONG. Exceeded permissions needed. C: CORRECT. D: WRONG. Exceeded permissions needed. Reference: https://gcp.permissions.cloud/predefinedroles/spanner.admin https://gcp.permissions.cloud/predefinedroles/spanner.databaseReader https://gcp.permissions.cloud/predefinedroles/spanner.backupWriter https://gcp.permissions.cloud/predefinedroles/spanner.databaseAdmin https://gcp.permissions.cloud/predefinedroles/spanner.databaseUser

upvoted 1 times

...