Correct is A.
As per google best practices it is recommended to use predefined roles and create groups to control access to multiple users with same responsibility
very useful
The organization creates a Google group for these external auditors and adds the current auditor to the group. This group is monitored and is typically granted access to the dashboard application
The organization creates a Google group for these external auditors and adds the current auditor to the group. This group is monitored and is typically granted access to the dashboard application.
https://cloud.google.com/iam/docs/job-functions/auditing#scenario_external_auditors
The correct answer is A.
This option follows Google-recommended practices, because it allows you to grant auditors access to view audit logs without granting them access to other resources in your project.
The other options are not as good:
* Option B is not as good, because it requires you to create two new custom IAM roles. This can be complex and time-consuming.
* Option C is not as good, because it grants auditors access to all audit logs in your project, including audit logs for resources that they do not need access to.
* Option D is not as good, because it grants auditors access to all data in your BigQuery datasets, including data that they do not need access to.
C
Option A, which suggests adding the auditors group to predefined roles, might not be as appropriate as using individual auditor user accounts. It's generally a best practice to assign permissions to specific users rather than groups, as it provides better granularity and control over access.
Correct Answer is B
By creating a custom IAM role, you can specify the exact permissions that the auditors need, and avoid granting them unnecessary permissions that come with predefined IAM roles. In this case, you can create two custom IAM roles: one for 'logging.viewer' and one for 'bigQuery.dataViewer', and grant the corresponding permissions to each role. Then, you can add the auditors group to these custom roles to give them access to the required logs and data.
Correct Answer is B
Option A is incorrect because the logging.viewer and bigQuery.dataViewer roles only grant read access to logs and data in BigQuery, respectively. These roles do not provide audit logging capabilities.
Option C is incorrect because it suggests adding individual user accounts to the roles, whereas the question specifically asks for adding an auditors group. In addition, adding individual user accounts can be difficult to manage and does not scale well as the number of auditors increases. It is generally recommended to use groups for managing access whenever possible.
Option D suggests adding the auditor user accounts to two new custom IAM roles, which could work. However, the question specifically asks for following Google-recommended practices. The recommended practice is to use predefined roles over custom roles whenever possible. Therefore, option B, which suggests adding the auditors group to two new custom IAM roles, is not recommended.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
coldpar
Highly Voted 4 years, 8 months agodroogie
4 years, 4 months agorobor97
3 years, 11 months agoadeice
3 years, 8 months agoJavierCorrea
Highly Voted 4 years, 4 months agoArtistS
1 year, 1 month agoEnamfrancis
Most Recent 2 months agoSeleth
3 months, 3 weeks agogarg.vnay
4 months agoandreiboaghe95
5 months, 2 weeks agosinh
10 months, 2 weeks agosinh
11 months, 1 week agothewalker
1 year agogsmasad
1 year agoArtistS
1 year, 1 month agoYourCloudGuru
1 year, 1 month agoCaptain1212
1 year, 2 months agosthapit
1 year, 3 months agoExamsFR
1 year, 4 months agovinodthakur49
1 year, 4 months agosmanoj85
1 year, 8 months agosmanoj85
1 year, 8 months ago