GCP Professional Cloud Security Engineer Practice Question

A DevOps team maintains an automation script that provisions Google Cloud projects and sets up their initial IAM posture. As part of onboarding a new project, the script must create a Google Group named "proj-analytics-admins" inside the organization example.com, assign it the Project IAM role roles/owner on the new project, and ensure that rerunning the script does not create duplicate groups. Which gcloud command sequence best satisfies these requirements while remaining idempotent?

Use gcloud identity groups describe [email protected] --format="value(name)" || gcloud identity groups create [email protected] --organization="123456789" --display-name="Project Analytics Admins", then call gcloud projects add-iam-policy-binding PROJECT_ID --member="group:[email protected]" --role="roles/owner".
Execute a single gcloud resource-manager set-iam-policy command with an inline JSON policy that both creates the group and assigns roles/owner to it for the new project.
Run gcloud iam service-accounts create proj-analytics-admins --display-name="Project Analytics Admins" followed by gcloud projects set-iam-policy PROJECT_ID policy.json where the policy grants Owner to the new service account.
Invoke the Groups Settings API to create a group named [email protected] and then set the Owner role by updating the group's settings with an HTTP PATCH request.

Report Issue

Answer Description

The most reliable way to create or look up a Cloud Identity Group within an organization and avoid duplication is to first attempt to fetch the group by its email address; if it does not exist, create it. The gcloud identity groups describe command exits with a non-zero status when the group is absent, which a script can test to decide whether to call gcloud identity groups create. After ensuring the group exists, the script can bind the desired IAM role with gcloud projects add-iam-policy-binding. Using gcloud iam service-accounts commands is incorrect because they manage service accounts, not Google Groups. The Resource Manager set-iam-policy command requires crafting a policy file and overwrites existing bindings, reducing idempotency. The Groups Settings API manages configuration of an existing group's properties; it cannot create groups or set project-level IAM bindings.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.