Google Professional Cloud Security Engineer Question 147
Single answerGoogle Cloud PlatformYour organization uses Google Cloud IAM extensively to manage access across multiple projects and resources. Recently, a security audit revealed that several service accounts have overly permissive IAM roles. To remediate this, you are tasked with identifying and revoking unused permissions while ensuring critical workflows are not disrupted. Which feature of Policy Intelligence should you use to address this requirement effectively?
- A
Policy Simulator
- B
IAM Recommender
- C
Access Transparency
- D
Cloud Audit Logs
Show answer and explanation
Correct answer: B
Explanation
IAM Recommender, a feature of Policy Intelligence, is designed to help organizations optimize IAM roles by analyzing actual usage patterns and identifying permissions that are not being used. In this scenario, it is the appropriate tool to identify and revoke unused permissions while ensuring that critical workflows remain unaffected. Other options, such as Policy Simulator or Cloud Audit Logs, serve different purposes and do not directly address the problem of unused permissions.
- A. Incorrect.
Policy Simulator is used to test the impact of IAM policy changes before applying them, but it does not identify unused permissions.
- B. Correct.
IAM Recommender analyzes IAM policies and provides recommendations to remove unused permissions, making it the ideal choice for this scenario.
- C. Incorrect.
Access Transparency provides visibility into Google Cloud administrator access to your data, but it does not deal with unused permissions or IAM roles.
- D. Incorrect.
Cloud Audit Logs record actions taken within Google Cloud resources, but they do not provide insights or recommendations for unused permissions.