Cloud Digital Leader Fundamental Cloud Concepts Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Grant the Organization Policy Administrator role

  Why it's wrong here

  The Organization Policy Administrator role is a highly privileged IAM role that allows modifying Organization Policies, which are the centralized constraints governing all resources in the Google Cloud resource hierarchy. Granting this to an external auditor would give them write access to governance rules, violating the read-only requirement and creating a risk of unauthorized policy changes. It is therefore incorrect because it exceeds the minimum access needed for an audit.

• ✓

  Grant the Viewer role at the project level

  Why this is correct

  The Viewer role at the project level is a predefined IAM role that grants read-only access to all resources and configurations within that project, including metadata, permissions, and runtime states, while preventing any modification or deletion. This makes it the ideal choice for a third-party auditor because it provides comprehensive visibility with zero write capability, adhering to the principle of least privilege. It is the correct answer because it fully satisfies the review requirement without exposing any administrative control.

• ✗

  Grant the Cloud Debugger role

  Why it's wrong here

  The Cloud Debugger role is designed for runtime debugging, allowing users to capture stack traces, set snapshots, and inject log points into running code. This role does not provide read-only access to project configurations or resources, and its debugging actions can actively alter the execution state of applications, making it unsuitable for a compliance auditor. It is incorrect because it focuses on low-level application behavior rather than a holistic view of the project's security and configuration.

• ✓

  Grant the Security Reviewer role

  Why this is correct

  The Security Reviewer role provides read-only access to specific security-related resources, such as IAM policies, organization policies, and Cloud Security Command Center findings. It is a valid read-only role, but it is scoped to security configurations only, meaning an auditor would miss non-security aspects like network, compute, and storage settings. While it is a correct and useful role for security auditing, it is not as complete as the project-level Viewer role for a comprehensive third-party review.

• ✓

  Enable Access Transparency logs for the project

  Why this is correct

  Enabling Access Transparency logs records actions taken by Google staff on your resources, which can be important for auditing Google's internal operations. However, this feature alone does not grant the auditor any access to the project; it merely creates logs that an auditor would need additional permissions to view. It serves as a supplementary audit aid but cannot replace a dedicated read-only IAM role, so it is correct as an added measure but insufficient as the primary solution.

Go deeper

Related to this question