Ensuring Least Privilege When Bootstrapping a Google Cloud Organization
Which THREE actions should be taken to ensure compliance with the principle of least privilege when bootstrapping a Google Cloud organization? (Choose 3)
Quick Answer
The answer is to grant roles at the project level rather than at the organization level when possible. This is correct because the principle of least privilege demands that identities receive only the permissions absolutely necessary for their function, and project-level roles inherently limit the blast radius of a compromised or misconfigured service account compared to organization-wide roles. On the Google Professional Cloud DevOps Engineer exam, this concept tests your understanding of IAM hierarchy and how to avoid over-permissioning during the initial organization setup—a common trap is assuming organization-level roles are needed for convenience, when in fact they create unnecessary risk. A key memory tip is to think "project-first, org-last" when assigning roles, and always default to the smallest scope that still allows the workload to function.
⚠ Common exam trap
Google Cloud often tests the misconception that assigning the Owner role at the organization level to a small group is acceptable for least privilege, when in fact the Owner role should be reserved for emergency break-glass accounts and never used for routine administration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use service accounts for automated processes and grant them the minimum required roles.
Service accounts are the recommended identity for automated processes in Google Cloud, and granting them only the minimum required roles directly implements the principle of least privilege. This prevents over-permissioning and reduces the attack surface for automated workflows.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use service accounts for automated processes and grant them the minimum required roles.
Why this is correct
Service accounts should have least privilege.
- ✓
Use custom roles that include only the necessary permissions.
Why this is correct
Custom roles allow granular permission assignment.
- ✓
Grant roles at the project level rather than at the organization level when possible.
Why this is correct
Limits scope of permissions.
- ✗
Assign the Owner role at the organization level to a small group of administrators.
Why it's wrong here
Owner is a high-privilege role; should be limited to project level if possible.
- ✗
Use primitive roles (Owner, Editor, Viewer) to simplify management.
Why it's wrong here
Primitive roles are too broad; use predefined or custom roles.
Go deeper
Related to this question
About these practice questions
This PCDOE question is part of Courseiva's 486-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on PCDOE
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is bootstrapping their Google Cloud organization for DevOps. They want to implement a least-privilege model for service accounts used by CI/CD pipelines. The pipelines need to deploy resources in multiple projects. What is the best practice for managing service account keys?
hard- A.Use a user account for the CI/CD pipeline and assign it the necessary roles.
- B.Store service account keys in Secret Manager and have the pipeline retrieve them at runtime.
- C.Generate a single service account key and securely distribute it to the CI/CD system.
- ✓ D.Use workload identity federation to allow the CI/CD system to impersonate a service account without keys.
Why D: Workload identity federation allows an external CI/CD system (e.g., Jenkins, GitHub Actions) to impersonate a Google Cloud service account without managing or storing any long-lived keys. This eliminates the security risk of key leakage and aligns with the least-privilege principle by enabling short-lived, scoped credentials via the Security Token Service (STS) and OAuth 2.0 token exchange.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCDOE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCDOE exam.