Google Professional Cloud Security Engineer Question 2
Select 3Google Cloud PlatformYour organization is using Google Cloud and wants to ensure secure access to resources by configuring Cloud Identity correctly. As part of the setup, you are tasked with creating and managing user accounts, ensuring proper authentication methods, and implementing policies to prevent unauthorized access. Which of the following actions should you take to properly manage Cloud Identity in this scenario?
- A
Enable multi-factor authentication (MFA) for all users in the Cloud Identity domain.
- B
Grant the 'Super Admin' role to all team members to ensure they have full access to manage Cloud Identity.
- C
Regularly review and audit user accounts to identify inactive or unnecessary accounts.
- D
Use context-aware access to enforce policies based on user location and device security posture.
- E
Allow users to share accounts to simplify identity management for temporary contractors.
Show answer and explanation
Correct answers: A, C, D
Explanation
To properly manage Cloud Identity, you must implement security best practices such as enabling MFA, auditing user accounts to mitigate risks from inactive or unnecessary accounts, and enforcing context-aware access to secure resources based on conditions. Avoid practices that violate security principles, such as granting excessive privileges or allowing account sharing.
- A. Correct.
Enabling MFA adds an additional layer of security to user authentication, making it harder for unauthorized users to access resources even if credentials are compromised.
- B. Incorrect.
Granting 'Super Admin' to all team members violates the principle of least privilege and increases the risk of accidental or malicious configuration changes.
- C. Correct.
Regularly reviewing and auditing user accounts helps identify and remove unused accounts, reducing the attack surface and limiting unauthorized access opportunities.
- D. Correct.
Context-aware access allows you to define access policies based on conditions like location and device security, enhancing security for your Cloud Identity setup.
- E. Incorrect.
Allowing users to share accounts undermines accountability and makes it difficult to trace actions to specific individuals, compromising security and compliance requirements.