Google Professional Cloud Security Engineer Question 1
Select 3Google Cloud PlatformYour organization has recently adopted Google Cloud and is using Cloud Identity to manage user authentication. You need to ensure that all users in your domain are properly managed and authenticated while minimizing security risks. Which of the following steps should you take to configure and manage Cloud Identity effectively?
- A
Enable two-step verification for all users in the domain.
- B
Grant all users the 'Super Admin' role to reduce friction in accessing resources.
- C
Set up automated user provisioning using a supported identity provider (IdP).
- D
Restrict the use of less secure apps that do not support OAuth 2.0.
- E
Disable account recovery options to prevent unauthorized access.
Show answer and explanation
Correct answers: A, C, D
Explanation
To effectively manage Cloud Identity, you need to implement best practices that enhance security and streamline user management. Enabling two-step verification, using automated user provisioning, and restricting less secure apps are key steps to secure the environment. Granting overly broad access or disabling useful features like account recovery can lead to security vulnerabilities or operational issues.
- A. Correct.
Enabling two-step verification adds an additional layer of security, reducing the risk of unauthorized access even if a user's password is compromised.
- B. Incorrect.
Granting all users the 'Super Admin' role is a security risk as it provides overly broad access to critical administrative functions. Roles should follow the principle of least privilege.
- C. Correct.
Setting up automated user provisioning ensures that users are added, updated, and removed efficiently, reducing manual errors and maintaining an up-to-date directory.
- D. Correct.
Restricting the use of less secure apps that do not support OAuth 2.0 enhances security by ensuring that only modern, secure authentication protocols are used.
- E. Incorrect.
Disabling account recovery options can lock out legitimate users without providing a significant security benefit. Instead, account recovery should be secure and well-managed.