Google Professional Cloud Security Engineer Question 156
Select 2Google Cloud PlatformYour organization uses Google Cloud and needs to enforce just-in-time access for administrators who manage sensitive resources, such as Cloud Storage buckets and Compute Engine instances. The goal is to minimize long-term privileged access while ensuring that administrators can request elevated permissions when necessary. Which steps should you take to implement this using Privileged Access Manager?
- A
Enable Access Approval for all projects in your organization.
- B
Set up predefined roles with elevated permissions and assign them permanently to administrators.
- C
Enable Privileged Access Manager and configure access levels for sensitive resources.
- D
Define workflows for just-in-time access requests using Access Context Manager.
- E
Set up Google Cloud IAM Conditions to restrict access based on time and justification.
Show answer and explanation
Correct answers: C, D
Explanation
Privileged Access Manager in Google Cloud is designed to enforce just-in-time access for sensitive resources. By enabling it and defining workflows for access requests, administrators can request elevated permissions only when needed, ensuring security and compliance. Access Approval and IAM Conditions are separate features with different use cases and are not directly relevant to implementing Privileged Access Manager.
- A. Incorrect.
Access Approval is used to manage access requests for Google support, not for internal just-in-time access management for administrators.
- B. Incorrect.
Assigning roles permanently contradicts the principle of just-in-time access, which aims to minimize long-term privileged access.
- C. Correct.
Enabling Privileged Access Manager is the core step in implementing just-in-time access. It helps manage elevated permissions securely.
- D. Correct.
Workflows for just-in-time access requests are a critical component of Privileged Access Manager. Access Context Manager can define conditions for such workflows.
- E. Incorrect.
IAM Conditions are useful for restricting access, but they are not a direct part of configuring Privileged Access Manager in this context.