Google Professional Cloud Security Engineer Question 148
Select 3Google Cloud PlatformYour organization uses Google Cloud and has several IAM roles assigned to users across projects. You notice that some users have permissions they don't actively use, which could pose a security risk. Which steps can you take using Policy Intelligence to reduce over-permissioned users while maintaining necessary access?
- A
Use the Recommender service to review IAM role recommendations and remove unused permissions.
- B
Enable Access Approval to block unused permissions from being used without approval.
- C
Review the policy insights provided by Policy Analyzer to identify overly permissive roles.
- D
Enable Policy Simulator to test the impact of removing specific permissions.
- E
Grant users the Storage Admin role temporarily to assess their actual permission usage.
Show answer and explanation
Correct answers: A, C, D
Explanation
Policy Intelligence tools, such as the Recommender service, Policy Analyzer, and Policy Simulator, are specifically designed to help optimize IAM policies by identifying and mitigating overly permissive roles. These tools allow you to analyze permissions usage, simulate policy changes, and implement adjustments safely, which is critical for reducing security risks while maintaining necessary access.
- A. Correct.
The Recommender service provides IAM role recommendations by analyzing permission usage and suggesting role adjustments to remove unused permissions.
- B. Incorrect.
Access Approval is used for authorizing sensitive operations, not for managing unused permissions. This option is not relevant to the scenario.
- C. Correct.
Policy Analyzer is a feature of Policy Intelligence that helps identify roles and policies that may grant unnecessary permissions, making it useful for identifying overly permissive roles.
- D. Correct.
Policy Simulator allows you to test the effect of removing or altering permissions, ensuring that necessary access is not disrupted during cleanup.
- E. Incorrect.
Granting the Storage Admin role temporarily does not align with the principle of least privilege and could exacerbate the problem rather than resolve it.