Google Professional Cloud Security Engineer Question 144
Select 3Google Cloud PlatformYour organization uses Google Cloud to host multiple applications. As a security engineer, you are tasked with ensuring that IAM policies are optimized and do not grant excessive permissions. To achieve this, you decide to use Policy Intelligence. Which of the following actions can you take to accomplish this goal?
- A
Use Policy Analyzer to simulate the impact of policy changes on user access.
- B
Use Policy Troubleshooter to identify why a user cannot access a specific resource.
- C
Use Policy Recommender to identify and remove overly permissive roles.
- D
Use Policy Validator to enforce compliance with organizational policies.
- E
Use IAM Recommender to downgrade roles to the minimum required permissions.
Show answer and explanation
Correct answers: A, C, E
Explanation
Policy Intelligence in Google Cloud provides tools like Policy Analyzer, Policy Recommender, and IAM Recommender to optimize IAM policies and ensure they grant only the necessary permissions. These tools enable security engineers to analyze, recommend, and simulate policy changes to improve security posture while maintaining operational functionality.
- A. Correct.
Policy Analyzer allows you to simulate the impact of policy changes on user access, helping you ensure that permissions are not overly permissive or restrictive.
- B. Incorrect.
Policy Troubleshooter is used to diagnose and resolve access issues but does not directly help in optimizing or reducing excessive permissions.
- C. Correct.
Policy Recommender is part of Policy Intelligence and helps identify and remove overly permissive roles by suggesting more restrictive roles.
- D. Incorrect.
Policy Validator is not a feature in Google Cloud Policy Intelligence. The name is misleading as it does not exist in the context of this topic.
- E. Correct.
IAM Recommender is a key tool within Policy Intelligence that helps reduce overly broad permissions by recommending role downgrades to the minimum required permissions.