A security reviewer at a fintech company is reading a project's IAM page and sees the basic roles Editor and Viewer assigned to several accounts. How do these basic roles differ from the granular roles offered for individual services?
Show answer and explanation
Answer: A
Basic roles, historically called primitive roles, are Owner, Editor and Viewer. They apply across almost every service inside a project, so granting Editor gives write access to far more than most teams need. Predefined roles are created for a particular product, such as a Compute Engine instance admin, and bundle only the permissions that product needs. Google recommends predefined roles, or custom roles where neither fits, to keep access limited.
Why the other options are wrong
- B. Predefined roles do not carry the same permissions as basic roles. An Editor grant covers far more actions than most single-service roles, so treating them as identical would hide the access actually being granted.
- C. Predefined roles remain fully supported and are the recommended way to grant access. Retiring them would break many existing bindings, and no such retirement has been announced.
- D. Basic roles are not reviewed for safety in the way the option suggests. They are broad by design, which is why Google advises against using them for production access in most cases.