Google Professional Cloud Security Engineer Question 143
Select 2Google Cloud PlatformYour organization requires that only employees accessing Google Cloud resources from corporate devices and within specific geographic locations are granted access to sensitive resources. How can you configure this requirement using Access Context Manager?
- A
Define an access level with device policy and geographic location restrictions, then assign it to the desired resources.
- B
Create a VPC Service Control perimeter and link it to an access level that includes device policy and geographic restrictions.
- C
Use IAM roles to restrict access based on device compliance and geographic locations.
- D
Define a policy constraint to enforce device and geographic restrictions, then apply it to the entire organization.
- E
Configure an access level with identity restrictions, assign it to the resource, and use a custom IAM role to enforce device compliance.
Show answer and explanation
Correct answers: A, B
Explanation
Access Context Manager is used to create access levels that enforce conditional access based on attributes like device compliance and geographic location. These access levels can be combined with VPC Service Controls to create secure perimeters for sensitive resources. IAM roles and policy constraints do not provide the required functionality for such conditional access enforcement.
- A. Correct.
Correct. Access Context Manager can define access levels with device policies and geographic restrictions, which can then be assigned to resources for conditional access.
- B. Correct.
Correct. VPC Service Controls can work with Access Context Manager access levels to enforce additional security restrictions, such as device compliance and geographic location, at the perimeter boundary.
- C. Incorrect.
Incorrect. IAM roles control permissions but cannot enforce conditional access based on device compliance or geographic location.
- D. Incorrect.
Incorrect. Policy constraints are not used for configuring fine-grained access conditions like device or geographic restrictions in Access Context Manager.
- E. Incorrect.
Incorrect. Identity restrictions in Access Context Manager do not enforce device compliance, and a custom IAM role is not used for such conditions.