Google Professional Cloud Security Engineer Question 10
Select 3Google Cloud PlatformYour company is using an on-premises Active Directory to manage users and groups. You are tasked with configuring Google Cloud Directory Sync (GCDS) to synchronize these user accounts with Google Workspace. Additionally, you need to implement single sign-on (SSO) with a third-party identity provider (IdP) to allow users to authenticate with their corporate credentials when accessing Google Cloud resources. Which steps should you take to achieve this?
- A
Install and configure the GCDS tool to synchronize users and groups from the on-premises Active Directory to Google Workspace.
- B
Configure a SAML-based single sign-on (SSO) integration with the third-party identity provider in the Google Admin Console.
- C
Enable multi-factor authentication (MFA) in Google Workspace to secure SSO logins.
- D
Ensure that the third-party IdP supports OAuth 2.0 and configure it as the primary authentication method for SSO.
- E
Test the GCDS synchronization and SSO setup with a small set of users before deploying it company-wide.
Show answer and explanation
Correct answers: A, B, E
Explanation
To configure GCDS and implement SSO with a third-party IdP, you need to synchronize on-premises users and groups to Google Workspace using the GCDS tool. Next, a SAML-based SSO integration must be set up in the Google Admin Console to enable authentication via the third-party IdP. Testing the setup with a small group of users ensures that both the synchronization and the SSO configuration are working correctly before scaling the deployment. While MFA enhances security, it is not a required step for this specific setup.
- A. Correct.
Correct. Installing and configuring GCDS is necessary to synchronize on-premises users and groups with Google Workspace, which is a prerequisite for allowing those users to access Google Cloud resources.
- B. Correct.
Correct. Configuring a SAML-based SSO integration with the third-party IdP in the Google Admin Console is a key step to enable single sign-on for users.
- C. Incorrect.
Incorrect. Enabling multi-factor authentication (MFA) is a good security practice but is not a required step for configuring GCDS or SSO with a third-party IdP.
- D. Incorrect.
Incorrect. While OAuth 2.0 is a widely-used authentication protocol, SAML is the protocol typically used for SSO configurations in Google Cloud with third-party IdPs.
- E. Correct.
Correct. Testing the GCDS synchronization and SSO setup with a small set of users is a best practice to ensure the configuration works as expected before full deployment.