Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Learn GCP > GCP IAM > Flashcards

GCP IAM Flashcards

1
Q

What is IAM?

A

Who can do what and what resourc. It is GCP’s identity and access manage.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

In GCP IAM what is a member?

A 
A member is a 'who', this can be a person or a service account.
Service account = Application access
People =
- Google account
- Google group
- G Suite Domain
- Google identity domain
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Can a GCP IAM member be a google account?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Can a GCP IAM Service account be a google account?

A

No, an application can be a service account

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is a google account?

A

It is a person interaction with Google and can be a Gmail account or can be a non-google account associated with a google account.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is a google group?

A

It is a collection of google accounts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is a G Suit Domain

A

Is a virtual group of domain users, it can not be used for individual identity but you can set permissions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

In GCP IAM, what is the hierarchy structure?

A

Organizations
Folders
Projets
Resoiurces

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

In GCP IAM, what is the main structure of IAS objects

A

Permissions -> Roles -> Policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is a GCP IAM permission?

A

It is a resource based permission, compute.instanceAdmin.v1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is a GCP IAM role?

A

A role is a collection of permissions, 100% completely different than AWS role.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is a GCP IAM policy?

A

It is a collection of roles and it is where a member (users) can become

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

When using GCP IAS, how can we think of IAS applied to an organization or an organization child?

A

Who
What they can do
Resources they can do it on

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How can we think of GCP IAM?

A

Members (who) are granted permissions and roles to GCP services (resource)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

In GCP IAM what is a service account?

A

It is a software application or service calling GCP, software application uses the service account to call GCP.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

In GCP ISA what is the permission format?

A

service. resource.action

compute. instance.delete

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

In GCP IAM can you give me an example of a permission?

A

compute.rinstance.delete

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Can you asign a permission direct to a member?

A

No, permissions are applied a role.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is a GCP IAM primitive role?

A

Includes owner, editor and viewer roles and existed before Cloud IAM. These roles (owner, editor and viewer) apply only to the project level.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is a GCP IAM role?

A

provide granular access servcies in GCP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is a GCP IAM custom role?

A

You cna build a custum role with your own permissions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What will the GCP prinitive role ‘Viewer’ allow you to do?

A

Read only and view resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What will the GCP prinitive role ‘Editior’ allow you to do?

A

Edit resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What will the GCP prinitive role ‘Owner’ allow you to do?

A

All editor permissions and,

  • Manage roles and permissions
  • Setup billing
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Can a member/user be granted multipal roles?
Yes
26
In GCP IAM, give an example of a predefined role?
roles/appEngine.appAdmin
27
In the following GCP IAM) role 'roles/appEngine.appAdmin', what will role enable you to do?
This role will give you admin permissions to theGCP App Engine.
28
What is a GCP IAM Policy?
An GCP IAM policy is a coletcion of GCP roles, a GCP IAM policy is not the same as a AWS policy
29
What you set a policy at the orgnizational level of GCP, will projects and resources inherate this policy?
Yes, as the orgnization is at the higest level all child resources inherate this policy. Resources inheriat from it parent.
30
If i give admin access at the orgnizational level and then give less rights at the project or resource level, will the user have less rights or admin rights?
Admin rights, the rights at the more pareent level will apply.
31
What are the 3 roles used in GCP IAM?
Primitive, Predefined, Custom?
32
What is a member?
People - Google account - Google group - Cloud identity domain - G Suit domain
33
What is a Role?
It is a collection of permissions.
34
What is a permission?
It defines if you have access to a resource or not.
35
What is a Cloud identity domain?
It is an orgnizatiuonal level domian, at root.
36
What is the format of a permission
- service.resource.verb | - compute.incstnace.delete
37
I need to asign permission directly to a user, can I do this?
No, permissions are asigned to roles
38
What are the 3 GCP IAM role types?
- Primitive - Predefined - Custom
39
What is a predefined GCP IAM role?
It is a more granular role then primitive role and has more granularity.
40
What is a predefined GCP IAM role?
It is an Owner, View, Editor role, no granular permissions.
41
What is a GCP IAM custom role?
It is a role you can create with you own permissions.
42
What is a GCP IAM service account?
It is an account attached to an application.
43
What is ba GCP IAM policy?
A policy is a collection of roles, the policy is asigned to a member.
44
Can a pareent policy overule a child policy?
Yes, 100%
45
I have a perant and child GCP IAM policies, whitch policy has final say?
Parent, fi there was deny rule in parent then there permission would be denied.
46
Do child policies inherate from parent?
Yes, 100%
47
Can I have a more restrictive Parent policy and grant permisisons in child policy?
Yes, 100%
48
What is a custom GCP role?
It is a collection of permissions?
49
I need to give a group of users a set of permissions, what do I need to create?
A role and assign a policy
50
What is a GCP IAM Object?
All users, resources, etc are IAM objects.
51
Do all members in the organization role have access to the resources allowed by the role?
The organization role has permissions that enable every member the is part of the organizational role to access a resource.
52
I need to give everyone in my organization access to a resource, how can I enable this?
Create a custom role with the set of permissions you need and assign the role to the org..
53
I need to give everyone in my organization access to a resource, how can I enable this?
Create a custom role with the set of permissions you need and assign the role to the domain member automatically created that refers to everyone in the organization.
54
By default everyone can create projects in an organization, how can we fix this so an admin is the only one that can create projects?
Remove the automatically created org member.
55
What are the two types of GCP service accounts available?
-Google-Managed --Represent Google services and are automatically granted an IAM role --Most times invisible to the user. -User-Managed --Created by you and based on enabled API's Both automatic created and user created.
56
How is User-managed service account authenticated by google?
API Key
57
What is a service account?
A service account is a special google account that belongs to your application or instance (VM). The application or the VM assumes the identity so users are not involved. -Service accounts can have zero or more key pairs to authenticate with Google.
58
I need to access an Cloud Storage bucket file form the bash CLI in a Compute instance, this will involve both read and write. How can I enable this access?
When you create an instance (VM) you are automatically assigned a service account. This service account has a set of scopes that enable it to access the GCP API's. The instance (VM) assumes this service account identity and can access the Cloud Storage bucket provided the scope has been set with the corretc read/write/full permissions.
59
Should I use primitive or predefined roles?
Use predefined roles, this way you only give them the least access as possible.
60
When I create a microservice with two services (app componets), should I give each one the same service account?
No, it is important to ensure you use the least privilege and give each of the services in the microservice a separate service account with only the access they need.
61
Can a child policy overrule a parent policy?
No a child policy can not overrule a child policy.
62
When assigning service account scope, what should I be doing for least privilege?
Allowing access for only API's needed to perform job function.
63
What IAM role is used when creating a service account
Service Account Admin
64
What do I need to do regularly to ensure service account security is maintained for user managed keys?
Rotate the service keys
65
Do I need to rotate GCP managed service account keys?
No
66
Can you assign a policy to a folder?
Yes
67
Are IAM Policies inherited down or up?
Down Org -> Folders -> Project -> Resource
68
For an organization level, what is the role that can change policies?
Organization policy administrator
69
What is the role of Organization policy administrator?
Responsible for admin policies.
70
What can an owner do?
``` Manage members (invite, delete, etc) Manage projects Deploy applications Modify code Configure services BUT CAN NOT DO BILLING RELATED ACTIVITIES LIKE A BILLING ADMIN CAN. ```
71
What can a editor do?
Deploy applications Modify code Configure services
72
Can I use custom roles at the folder level?
No, you can only use custom roles at the project or org level
73
Can I apply different roles to a service account?
Yes, this enables you to restrict the service account to only access what is needed.
74
Can I deny access to a project resource through IAM when I have give the permission at the ORG level?
No, you cannot deny permissions lo down in hierarchy when you have give them high up.
75
I have an Owner role applied at the organization level, will the owner role have any effect?
No, Owner roles will only have an effect the the project level as the owner role has no permissions at levels above project.
76
Should I use primitive or predefined rules?
I should use predefined rules where possible as they are more granular.
77
What is an organization policy used for?
- Centralize control to configure restrictions on how your organization’s resources can be used. - Define and establish guardrails for your development teams to stay within compliance boundaries. - Help project owners and their teams move quickly without worry of breaking compliance.
78
Do descendants policies inherit from parents?
Yes

Learn GCP (34 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions