Discuss Google Professional Cloud DevOps Engineer Exam Topic 1 Question 88

Your company's security team needs to have read-only access to Data Access audit logs in the _Required bucket You want to provide your security team with the necessary permissions following the principle of least privilege and Google-recommended practices. What should you do?

AAssign the roles/logging, viewer role to each member of the security team

BAssign the roles/logging. viewer role to a group with all the security team members

CAssign the roles/logging.privateLogViewer role to each member of the security team

DAssign the roles/logging.privateLogviewer role to a group with all the security team members

Suggested Answer: B, E

The correct answers are B and E

A good postmortem should include what caused the incident, how the incident could have been worse, and how to prevent a future occurrence of the incident1. This helps to identify the root cause of the problem, the impact of the incident, and the actions to take to mitigate or eliminate the risk of recurrence.

A good postmortem should also include all incident participants in postmortem authoring and share postmortems as widely as possible2. This helps to foster a culture of learning and collaboration, as well as to increase the visibility and accountability of the incident response process.

Answer A is incorrect because it assigns blame to a person or team, which goes against the principle of blameless postmortems2. Blameless postmortems focus on finding solutions rather than pointing fingers, and encourage honest and constructive feedback without fear of punishment.

Answer C is incorrect because it omits how the incident could have been worse, which is an important factor to consider when evaluating the severity and impact of the incident1. It also avoids naming internal system components, which makes it harder to understand the technical details and root cause of the problem.

Answer D is incorrect because it omits how to prevent a future occurrence of the incident, which is the main goal of a postmortem1. It also avoids naming customer information, which may be relevant for understanding the impact and scope of the incident.

Get Premium Professional Cloud DevOps Engineer Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

35 comments · newest first

Royal 11 months ago

D seems like overkill, just use B!

Deeanna 11 months ago

Wait, are we sure about the privateLogViewer role? Sounds sketchy.

Blondell 11 months ago

Definitely B, it's cleaner and follows best practices.

Veronika 11 months ago

I think A is better for individual control.

Kanisha 12 months ago

B is the way to go for group access!

Sena 12 months ago

I feel like option D might be the best approach since it assigns the role to a group, but I’m not entirely confident about the naming conventions.

Germaine 1 year ago

I’m a bit confused about the difference between the viewer role and the privateLogViewer role. Does anyone remember which one is more appropriate for read-only access?

Viola 1 year ago

I remember practicing a similar question, and I think assigning roles to a group is more efficient. Maybe option B is the right choice?

Amber 1 year ago

I think we should focus on the principle of least privilege, but I'm not sure if assigning roles to individuals or a group is better.

Juliann 1 year ago

I'm not sure about the difference between the "roles/logging.viewer" and "roles/logging.privateLogViewer" roles. I think I'll need to do some more research on the Google-recommended practices before deciding on the best option.

Micah 1 year ago

I'm pretty confident that option A is the way to go here. Assigning the roles/logging.viewer role to each member of the security team seems like the most straightforward and least privileged approach.

Monte 1 year ago

Okay, let's think this through. The question says we want to provide read-only access, so we need to use a role that gives that level of access. I'm leaning towards option D - assigning the roles/logging.privateLogViewer role to a group with all the security team members.

Katie 1 year ago

I'm a bit confused here. Is the "roles/logging.viewer" role the same as the "roles/logging, viewer" role? I'm not sure which one is the correct choice.

Jenise 1 year ago

Hmm, this seems pretty straightforward. I think I'll go with option B - assigning the roles/logging.viewer role to a group with all the security team members.

Franchesca 1 year ago

Wait, is this a trick question? What's with all these 'logging' and 'privateLogViewer' roles? I thought we were just supposed to give them read-only access. *scratches head*

Shawna 1 year ago

↳ replying to Franchesca

It's not a trick question, just make sure to follow the principle of least privilege and give them only the necessary permissions.

Richelle 1 year ago

↳ replying to Franchesca

You can also consider using the 'roles/logging.privateLogViewer' role for more restricted access to the logs.

Rikki 1 year ago

↳ replying to Franchesca

You can assign the 'roles/logging.viewer' role to the security team for read-only access to Data Access audit logs.

Laurel 1 year ago

I'm going with option D. Assigning the role to a group is more efficient, and the privateLogViewer role sounds like it's the right one for the task.

Gary 1 year ago

↳ replying to Laurel

Let's go with that option then.

Bo 1 year ago

↳ replying to Laurel

PrivateLogViewer role seems like the right one for the task.

Stacey 1 year ago

↳ replying to Laurel

Option D sounds good. Assigning the role to a group is efficient.

Rosenda 1 year ago

Option A is the way to go! Assigning the roles/logging.viewer role to each team member is the simplest and most straightforward approach.

Kizzy 2 years ago

Hmm, I'm not sure about this one. Shouldn't we be using the roles/logging.viewer role instead of the privateLogViewer role? I'm a bit confused.

Abraham 1 year ago

↳ replying to Kizzy

B) Assign the roles/logging.viewer role to a group with all the security team members

Chan 1 year ago

↳ replying to Kizzy

A) Assign the roles/logging.viewer role to each member of the security team

Gene 2 years ago

Option D seems like the correct answer to me. Assigning the privateLogViewer role to a group ensures that the security team has the necessary read-only access.

Maryann 2 years ago

I think option B is the way to go. Assigning the role to a group makes it easier to manage permissions and follows the principle of least privilege.

Chauncey 1 year ago

↳ replying to Maryann

Assigning roles to a group with all security team members is a good way to ensure consistency and ease of management.

Peggie 1 year ago

↳ replying to Maryann

It's important to follow Google-recommended practices when setting up permissions for security teams.

Jennifer 1 year ago

↳ replying to Maryann

Assigning the role to a group simplifies the process and ensures least privilege access.

Cecil 1 year ago

↳ replying to Maryann

I agree, option B is definitely the best choice for managing permissions efficiently.

Peggie 2 years ago

I prefer assigning the roles/logging.viewer role to a group with all the security team members. It's more efficient.

Yolando 2 years ago

I agree with Davida. It's important to follow the principle of least privilege.

Davida 2 years ago

I think we should assign the roles/logging.viewer role to each member of the security team.

Google Professional Cloud DevOps Engineer Exam - Topic 1 Question 88 Discussion