Free Preparation Discussions
MENU
Google Associate Cloud Engineer Exam - Topic 1 Question 120 Discussion
Topic #: 1
You need to configure IAM access audit logging in BigQuery for external auditors. You want to follow Google-recommended practices. What should you do?
https://cloud.google.com/iam/docs/job-functions/auditing#scenario_external_auditors
Because if you directly add users to the IAM roles, then if any users left the organization then you have to remove the users from multiple places and need to revoke his/her access from multiple places. But, if you put a user into a group then its very easy to manage these type of situations. Now, if any user left then you just need to remove the user from the group and all the access got revoked
The organization creates a Google group for these external auditors and adds the current auditor to the group. This group is monitored and is typically granted access to the dashboard application. During normal access, the auditors' Google group is only granted access to view the historic logs stored in BigQuery. If any anomalies are discovered, the group is granted permission to view the actual Cloud Logging Admin Activity logs via the dashboard's elevated access mode. At the end of each audit period, the group's access is then revoked. Data is redacted using Cloud DLP before being made accessible for viewing via the dashboard application. The table below explains IAM logging roles that an Organization Administrator can grant to the service account used by the dashboard, as well as the resource level at which the role is granted.
Annita
4 days agoSilva
9 days agoSalome
14 days agoLindsey
19 days agoDelila
24 days agoChristiane
30 days agoColene
1 month agoAlfreda
1 month agoParis
2 months agoRosenda
2 months agoCaprice
2 months agoDonte
2 months agoGlory
2 months agoRemedios
2 months agoLarae
4 months agoEnola
4 months agoStephen
4 months ago