Google Cloud Professional Cloud Security Engineer Practice Exam

What permission is needed for Engineering Group A to attach a Compute Engine instance to a specific subnet in Shared VPC?

1. Compute Network User Role at the project level

2. Compute Network User Role at the subnet level

3. Compute Admin Role

4. Viewer Role

The correct answer is: Compute Network User Role at the subnet level

To attach a Compute Engine instance to a specific subnet in a Shared VPC, the Engineering Group A requires the appropriate permissions that are specific to the subnet. The Compute Network User role at the subnet level provides the necessary permissions for users to attach or modify resources with respect to that particular subnet. This role allows the group to use the network and connect to the subnet, ensuring that they can effectively assign or modify the Compute Engine instance as needed. The specificity of permissions at the subnet level is crucial in a Shared VPC environment, where the resources managed in different projects might need distinct levels of access. This granular control helps maintain security and compliance, allowing only designated groups to interact with the network resources associated with that subnet. Permissions at the project level or roles like Compute Admin may provide broader capabilities that are not specifically tailored to subnet management, and therefore are not the best fit for this specific task. Similarly, roles like Viewer provide read-only access and do not grant the necessary permissions required for the action of attaching instances, making them insufficient for Engineering Group A’s purpose.