Correct Answer: Use IAM Conditions to restrict the developer's permissions based on resource labels (e.g., `env=prod`) or use separate service accounts with least-privilege roles per environment
IAM Conditions allow granting permissions only when specific resource attributes (like labels, resource names, or time-of-day) match. A condition like `resource.labels["env"] != "p...
Correct Answer
Use IAM Conditions to restrict the developer's permissions based on resource labels (e.g., `env=prod`) or use separate service accounts with least-privilege roles per environment
Why This Answer Is Correct
IAM Conditions allow granting permissions only when specific resource attributes (like labels, resource names, or time-of-day) match. A condition like `resource.labels["env"] != "prod"` prevents the developer from modifying production resources even from Cloud Shell. Separately, developers should use non-prod service accounts with restricted roles. Disabling Cloud Shell organization-wide harms productivity. VPC Service Controls restrict service APIs, not IAM permissions on labeled resources.
Your Cloud Function processes images uploaded to Cloud Storage. It intermittently times out on large files. The function is configured with 60s timeout and 256MB memory. What is the most effective fix?
A Cloud Function triggered by Pub/Sub is executing duplicate processing for some messages. Your team suspects at-least-once delivery is causing duplicate triggers. What is the recommended pattern to achieve exactly-once processing?
A Cloud Architect needs to run a resource-intensive script (processing 10GB of data) that takes 2+ hours to complete. Cloud Shell sessions terminate after 20 minutes of inactivity. What is the best approach?
What persists between Cloud Shell sessions?
A developer needs to preview a web application running on port 8080 inside Cloud Shell without exposing it publicly. What feature enables this?