Courseiva
← GCDL
Full test
Trust and security with Google Cloud →mediumMultiple ChoiceObjective-mapped

Cloud Digital Leader Trust and security with Google Cloud Practice Question

A security team is reviewing a developer's request to be granted the 'Owner' role on a production Google Cloud project 'just in case they need broad access.' The security team rejects this and instead grants a more specific role. Which security principle does the security team's decision enforce?

⚠ Common exam trap

Google Cloud often tests the principle of least privilege by presenting a scenario where a broad role is requested 'just in case,' and candidates may confuse it with separation of duties or defense in depth, but the key is that the decision limits permissions to the minimum needed for the task.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Principle of least privilege, by granting only the minimum permissions necessary for the developer's specific role and tasks

The security team's decision to reject the overly broad 'Owner' role and grant a more specific role directly enforces the principle of least privilege. This principle dictates that users should be granted only the minimum permissions necessary to perform their job functions, reducing the risk of accidental or malicious misuse of elevated access. In Google Cloud, this is implemented by assigning predefined or custom IAM roles with precisely scoped permissions rather than broad roles like Owner.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    Defense in depth, by ensuring multiple security layers protect the project

    Why it's wrong here

    Defense in depth is a layered security strategy. While related to overall security posture, the specific decision to reject an overly broad role in favor of minimum necessary permissions is the Principle of Least Privilege.

  • ✗

    Separation of duties, by ensuring no single person has too many responsibilities

    Why it's wrong here

    Separation of duties is a control designed to prevent fraud and error by requiring multiple individuals to complete critical tasks (e.g., one person requests access, another approves it). In this scenario, the issue is not that a single developer is performing conflicting tasks; rather, the proposed IAM role grants far broader permissions than needed. Rejecting the Owner role and issuing a narrowly scoped role is about limiting permission breadth, not about splitting task responsibilities across people. Therefore, separation of duties does not explain the decision to use the minimum necessary permissions.

  • ✓

    Principle of least privilege, by granting only the minimum permissions necessary for the developer's specific role and tasks

    Why this is correct

    The Principle of Least Privilege is the core concept here. Owner role is far broader than necessary. By granting a specific role matching actual requirements, the security team limits the blast radius if the developer's account is compromised and reduces the risk of accidental destructive actions.

  • ✗

    Zero trust networking, by treating the developer's device as untrusted

    Why it's wrong here

    Zero trust networking is a security model that assumes no implicit trust based on network location, requiring continuous verification of every device and user (e.g., device posture checks, short-lived credentials). The scenario does not mention the developer's device being untrusted or any network-level authentication challenges; it is purely about the identity and access management (IAM) role assigned to the developer. Granting the Owner role versus a custom role is a question of authorization scope, not of device trust or network segmentation. Thus, zero trust is not the principle driving the rejection of the overly broad role.

About these practice questions

One of 829 original GCDL practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.