• Jour
  • New member
  • Offline

Topic: Professional Cloud Network Engineer topic 1 question 30

You have recently been put in charge of managing identity and access management for your organization. You have several projects and want to use scripting and automation wherever possible. You want to grant the editor role to a project member.
Which two methods can you use to accomplish this? (Choose two.)

A.
GetIamPolicy() via REST API
B.
setIamPolicy() via REST API
C.
gcloud pubsub add-iam-policy-binding Sprojectname --member user:Susername --role roles/editor
D.
gcloud projects add-iam-policy-binding Sprojectname --member user:Susername --role roles/editor
E.
Enter an email address in the Add members field, and select the desired role from the drop-down menu in the GCP Console.

Re: Professional Cloud Network Engineer topic 1 question 30

Correct Answer are (D) & (E)

GetIamPolicy and SetIamPolicy is only for service accounts. But question asks for a project members.
Hence, D and E are correct ans.
D - https://cloud.google.com/iam/docs/granting-changing-revoking-access#granting-gcloud-manual
E - https://cloud.google.com/iam/docs/granting-changing-revoking-access#access-control-via-console

Re: Professional Cloud Network Engineer topic 1 question 30

Yes, D and E are correct

  • dzhu
  • New member
  • Offline

Re: Professional Cloud Network Engineer topic 1 question 30

E is not scripting and automation. So E is obviously wrong. The answer should be B and D

Re: Professional Cloud Network Engineer topic 1 question 30

@dzhu is correct , question says should use scripting and automation, so obvious answer is BD

Re: Professional Cloud Network Engineer topic 1 question 30

A) GetIamPolicy()  would not do anything by itself but see (B)
B) would require use of GetIamPolicy() as otherwise SetIamPolicy() override existing binding
C) obviously wrong, question is not about pubsub
D) the documentation indicate that project_id need to be used not project_name, would therefore return an error
E) would work, despite being very vague, but is not automation.

Now, the question ask for "which 2 _methods_ can be used to achieve that".

Both GetIamPolicy()  and SetIamPolicy() are programatic _methods_ that if used together could achieve that.

Therefore one could roll with A&B in the spirits of that very tricky question.

Re: Professional Cloud Network Engineer topic 1 question 30

Agree with you. A, B will be correct hence D provide wrong parameter regarding Project Name

  • BenMS
  • New member
  • Offline

Re: Professional Cloud Network Engineer topic 1 question 30

In answer D, "project_name" is the name of a parameter inserted by the programmer. The fact it's a confusing name does not affect its accuracy.

I agree B is a correct answer.

Therefore I think the correct answers are B & D.

Re: Professional Cloud Network Engineer topic 1 question 30

D and B.

  • rick2
  • New member
  • Offline

Re: Professional Cloud Network Engineer topic 1 question 30

B) https://cloud.google.com/resource-manager/reference/rest/v1/projects/setIamPolicy
D) https://cloud.google.com/sdk/gcloud/reference/projects/add-iam-policy-binding

Re: Professional Cloud Network Engineer topic 1 question 30

BD are correct. Scripting and Automation!

  • Mo7y
  • New member
  • Offline

Re: Professional Cloud Network Engineer topic 1 question 30

Keywords: scripting and automation + the word "methods"
search for the word "method" in the below documentation and see where it's mentioned smile

https://cloud.google.com/iam/docs/granting-changing-revoking-access#multiple-roles-programmatic

Re: Professional Cloud Network Engineer topic 1 question 30

Option D is correct because it uses the gcloud command-line tool to add an IAM policy binding to a project. This command adds a new IAM policy binding to a project, granting the specified user the editor role.

Option E is correct because it describes the process of using the GCP Console to grant the editor role to a project member. This can be done by entering the member's email address in the Add members field and selecting the editor role from the drop-down menu.

Re: Professional Cloud Network Engineer topic 1 question 30

You should read the question well , It says use scripting and automation , E is a manual process so answer is BD

Re: Professional Cloud Network Engineer topic 1 question 30

B & D are correct.
B. setIamPolicy() via REST API - This method updates the IAM policy for a resource, such as a project, and allows you to add or modify members and their roles.
D. gcloud projects add-iam-policy-binding Sprojectname --member user:Susername --role roles/editor - This method uses the gcloud command-line tool to add an IAM policy binding for a specific project and member.
Option A is not sufficient because getIamPolicy() only retrieves the current IAM policy for a resource, but does not allow for modifying it.
Option C is not sufficient because it is a command for Pub/Sub, not for managing IAM policies for projects.
Option E is not sufficient because it requires manual interaction with the GCP Console, and cannot be easily scripted or automated.

Re: Professional Cloud Network Engineer topic 1 question 30

I think BD are the correct ones by elimination:

A. GetIamPolicy() - read only method and BTW with a typo (should be getIAmPolicy but I guess that's not the intenional mistake)
B. setIamPolicy() via REST API - does the job!
C. gcloud pubsub add-iam-policy-binding Sprojectname --member user:Susername --role roles/editor - nothing to do because points to pubsub
D. gcloud projects add-iam-policy-binding Sprojectname --member user:Susername --role roles/editor - does the job!
E. Enter an email address in the Add members field, and select the desired role from the drop-down menu in the GCP Console. - no automation option

Re: Professional Cloud Network Engineer topic 1 question 30

two methods for set permissions

  • pk349
  • New member
  • Offline

Re: Professional Cloud Network Engineer topic 1 question 30

A. GetIamPolicy() via REST API
B. setIamPolicy() via REST API

Re: Professional Cloud Network Engineer topic 1 question 30

I go for AB because of EranSolstice explanaition seems correct to me, see https://cloud.google.com/iam/docs/granting-changing-revoking-access#multiple-roles
No idea why people vote for E - this is not automation at all.

  • GCP72
  • New member
  • Offline

Re: Professional Cloud Network Engineer topic 1 question 30

I think D&E is correct answer

Re: Professional Cloud Network Engineer topic 1 question 30

I'd vote A and B as @EranSolstice says, because of the following exceprt from here https://cloud.google.com/iam/docs/granting-changing-revoking-access#multiple-roles

To make large-scale access changes that involve granting and revoking MULTIPLE roles, use the read-modify-write pattern to update the resource's IAM policy:

    Reading the current policy by calling getIamPolicy().
    Editing the returned policy, either by using a text editor or programmatically, to add or remove any principals or role bindings.
    Writing the updated policy by calling setIamPolicy().

Re: Professional Cloud Network Engineer topic 1 question 30

I'd vote A and B as @EranSolstice says, because of the following exceprt from here https://cloud.google.com/iam/docs/granting-changing-revoking-access#multiple-roles

To make large-scale access changes that involve granting and revoking MULTIPLE roles, use the read-modify-write pattern to update the resource's IAM policy:

    Reading the current policy by calling getIamPolicy().
    Editing the returned policy, either by using a text editor or programmatically, to add or remove any principals or role bindings.
    Writing the updated policy by calling setIamPolicy().

Re: Professional Cloud Network Engineer topic 1 question 30

B&D are correct.

Re: Professional Cloud Network Engineer topic 1 question 30

Tricky question, I would say B and D since automation is the prefered choice. But for B, see bellow .. probably better than manually as in E but it implies that you have all other IAM Setting and apply them all together ..

CAUTION: This method will replace the existing policy, and cannot be used to append additional IAM settings.

https://cloud.google.com/resource-manager/reference/rest/v1/projects/setIamPolicy