Google Professional Cloud Security Engineer Question 146
Single answerGoogle Cloud PlatformYour organization uses Google Cloud and wants to ensure that IAM roles are assigned with the principle of least privilege. As a Professional Cloud Security Engineer, you are tasked with identifying and revoking permissions that are granted but not actively used. Which Policy Intelligence feature can you use to achieve this goal?
- A
Recommender for IAM
- B
Policy Simulator
- C
Access Approval
- D
Cloud Audit Logs
Show answer and explanation
Correct answer: A
Explanation
Recommender for IAM is part of Google Cloud's Policy Intelligence suite and is specifically designed to analyze IAM policies and provide recommendations to remove overly permissive access. This helps organizations adhere to security best practices, such as the principle of least privilege. Other options, while useful in different contexts, do not address the specific task of identifying and removing unused permissions.
- A. Correct.
Recommender for IAM provides actionable recommendations to remove unused permissions, ensuring adherence to the principle of least privilege.
- B. Incorrect.
Policy Simulator is used to test the impact of policy changes before applying them but does not identify unused permissions.
- C. Incorrect.
Access Approval is used to enforce user-initiated permission requests and approvals but does not address unused permissions.
- D. Incorrect.
Cloud Audit Logs record activity within the system but do not provide recommendations for unused permissions.