Cloud Digital Leader Trust and security with Google Cloud Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  All users should have read-only access to prevent accidental changes.

  Why it's wrong here

  Granting all users read-only access is a blunt instrument that violates least privilege because it strips away the write, create, or modify permissions that legitimate job functions require. Read-only is only appropriate for truly passive roles like auditors or dashboards; for everyone else it cripples productivity, and it still overexposes sensitive data to users who don't need it. Accidental changes are better mitigated through version control, approval workflows, and audit logs than by erasing all write capability.

• ✓

  Users and services should be granted only the minimum permissions required for their specific function, nothing more.

  Why this is correct

  Least privilege means assigning IAM roles to users and service accounts that contain exactly the permissions needed for their job function and nothing extra. For example, a developer who deploys a Cloud Run app needs roles like roles/run.invoker or roles/run.developer, not broader roles like roles/bigquery.admin. This minimizes the attack surface and blast radius if a credential is compromised, and it aligns with Google Cloud's policy of scoping roles to specific resources, conditions, and identities. It is not about being maximally restrictive; it is about being exactly restrictive enough.

• ✗

  Administrators should have full access so they can respond to any emergency quickly.

  Why it's wrong here

  Standing full admin access for all administrators is the opposite of least privilege and creates a persistent, high-risk attack surface. Instead, administrators should use just-in-time elevated privileges, such as Privileged Access Manager or temporary roles, and only claim broad permissions during an actual emergency. Permanent admin roles bypass audit separation, make it impossible to attribute emergency actions cleanly, and violate the principle that no one should have more access than their real-time tasks demand. Even break-glass access should be monitored, time-boxed, and revoked after use.

• ✗

  All employees should share the same IAM role to simplify permission management.

  Why it's wrong here

  Assigning the same IAM role to all employees eliminates role-based access control and breaks separation of duties because people with different job functions—engineers, finance, HR—would all get identical permissions. This creates both overprivileging (someone in HR gets infrastructure admin) and underprivileging (engineers cannot perform deployment tasks), while destroying the individual audit trail needed to attribute actions in Cloud Logging. IAM is designed for granular, per-identity role assignments, and shared roles also make it impossible to rotate credentials or revoke access for a single user without disrupting everyone.

Go deeper

Related to this question