Google Professional Cloud Security Engineer Question 158
Select 2Google Cloud PlatformYour organization uses Google Cloud for its infrastructure and has a strict security policy requiring just-in-time (JIT) access for administrators to manage sensitive resources. You need to implement a solution that ensures administrators can access specific resources only when necessary and only after receiving explicit approval. Which of the following steps should you take to address this requirement?
- A
Enable Privileged Access Manager in the Google Cloud Console and configure Access Approval policies for critical resources.
- B
Create a custom IAM role that grants elevated permissions and assign it to administrators on an as-needed basis.
- C
Configure Access Context Manager to enforce fine-grained access control policies for privileged users.
- D
Set up access requests in Privileged Access Manager and define approval workflows for sensitive operations.
- E
Integrate Privileged Access Manager with Cloud Logging to monitor all access requests and approvals.
Show answer and explanation
Correct answers: A, D
Explanation
Privileged Access Manager in Google Cloud is specifically designed to enforce just-in-time access with explicit approval workflows for sensitive operations. By enabling Privileged Access Manager and configuring Access Approval policies, along with defining approval workflows for access requests, you ensure that administrators can only access resources when necessary and after proper authorization. Other options like custom IAM roles or Access Context Manager are not suitable for this specific use case.
- A. Correct.
Correct: Enabling Privileged Access Manager and configuring Access Approval policies ensures that just-in-time access is enforced and administrators can only access resources after explicit approval.
- B. Incorrect.
Incorrect: Creating a custom IAM role with elevated permissions does not fulfill the just-in-time access requirement and can increase the security risk if permissions are misused.
- C. Incorrect.
Incorrect: Access Context Manager is used for defining access policies based on attributes like IP addresses or device security posture, but it does not provide just-in-time access or approval workflows.
- D. Correct.
Correct: Setting up access requests and approval workflows in Privileged Access Manager is a key step to ensure that administrators receive temporary access only after approvals.
- E. Incorrect.
Incorrect: While integrating with Cloud Logging helps monitor access, it does not directly enforce just-in-time access or approval workflows.