Google Professional Cloud Security Engineer Question 161
Select 3Google Cloud PlatformYour organization needs to restrict elevated permissions for high-risk tasks to specific users on a just-in-time basis. You are tasked with configuring Privileged Access Manager (PAM) in Google Cloud to meet this requirement. Which actions should you take as part of the configuration process?
- A
Define access policies for specific high-risk tasks within Privileged Access Manager.
- B
Enable Identity and Access Management (IAM) audit logs for tracking privileged access.
- C
Create and configure access approval workflows for just-in-time access requests.
- D
Assign high-risk roles permanently to users within Identity and Access Management (IAM).
- E
Implement a time-bound access policy to automatically revoke privileges after a specified duration.
Show answer and explanation
Correct answers: A, C, E
Explanation
To configure Privileged Access Manager for just-in-time access, you need to define access policies for high-risk tasks, configure approval workflows, and implement time-bound access policies. These steps ensure privileges are only granted when needed and automatically revoked after the task is completed, enhancing security. Enabling IAM audit logs is not specific to Privileged Access Manager, and permanently assigning roles contradicts the just-in-time access model.
- A. Correct.
Defining access policies for specific high-risk tasks is essential in Privileged Access Manager to determine which tasks require elevated permissions and how access is controlled.
- B. Incorrect.
While enabling IAM audit logs is a good security practice, this step is not directly related to configuring Privileged Access Manager for just-in-time access.
- C. Correct.
Access approval workflows are a critical part of just-in-time access in Privileged Access Manager, as they ensure elevated permissions are only granted after proper approval.
- D. Incorrect.
Assigning high-risk roles permanently to users contradicts the purpose of Privileged Access Manager, which is to grant temporary, just-in-time elevated access.
- E. Correct.
Implementing a time-bound access policy is crucial for just-in-time access, as it ensures elevated permissions are automatically revoked after the specified duration, reducing security risks.