GCP Associate Cloud Engineer Practice Question

A project owner needs to let the networking team create and update VPC firewall rules and routes in a specific Google Cloud project. The team must not be able to create or modify Compute Engine VM instances, disks, or images. Which IAM role granted at the project level best follows the principle of least privilege?

Compute Security Admin (roles/compute.securityAdmin)
Editor (roles/editor)
Compute Admin (roles/compute.admin)
Compute Network Admin (roles/compute.networkAdmin)

Report Issue

Answer Description

The Compute Network Admin predefined role (roles/compute.networkAdmin) is designed for networking tasks within Compute Engine. It lets principals create, modify, and delete networks, subnets, firewall rules, and routes, but it does not include permissions to manage VM instances, disks, or images.

Other options are overly permissive or insufficient:

Compute Admin (roles/compute.admin) includes broad permissions to create, modify, and delete most Compute Engine resources-including VM instances and disks-violating least-privilege principles.
Editor (roles/editor) is a primitive role that grants wide-ranging write access to nearly all Google Cloud services in the project, far beyond what is required.
Compute Security Admin (roles/compute.securityAdmin) allows management of firewall rules but also grants instance stop/start and some image operations, exceeding the stated requirements.

Therefore, roles/compute.networkAdmin is the most appropriate predefined role.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.