Google Professional Cloud Security Engineer Question 145
Select 3Google Cloud PlatformYour organization uses Google Cloud and wants to ensure that IAM policies are not overly permissive. You are tasked with optimizing permissions using Policy Intelligence tools. Which actions should you take to achieve this goal?
- A
Use the Policy Analyzer to identify overly permissive roles assigned to users.
- B
Enable Policy Simulator to test the impact of removing or modifying permissions before making changes.
- C
Manually review all IAM policies and compare them with organizational security requirements.
- D
Use Recommender to identify and apply least privilege role recommendations.
- E
Disable Policy Intelligence features to prevent unnecessary recommendations and alerts.
Show answer and explanation
Correct answers: A, B, D
Explanation
To optimize IAM policies and ensure they are not overly permissive, you can leverage Policy Intelligence tools such as Policy Analyzer, Policy Simulator, and Recommender. These tools provide recommendations, simulate changes, and help enforce the principle of least privilege without manual effort. Avoid disabling these features as they are designed to enhance security and simplify policy management.
- A. Correct.
Policy Analyzer is part of Policy Intelligence and helps identify overly permissive roles by analyzing IAM policies and permissions. This is a valid action to optimize permissions.
- B. Correct.
Policy Simulator allows you to test changes to IAM roles or permissions before applying them, helping ensure they do not disrupt workflows. This is a valid action.
- C. Incorrect.
Manually reviewing all IAM policies is time-consuming and prone to human error. Policy Intelligence tools are designed to automate and simplify this process, making this option less effective.
- D. Correct.
Recommender provides actionable least privilege role recommendations by analyzing usage patterns, which is a key step in optimizing IAM permissions.
- E. Incorrect.
Disabling Policy Intelligence features would prevent the use of tools like Policy Analyzer, Policy Simulator, and Recommender, which are essential for optimizing permissions. This is not a valid action.