Google Professional Cloud Security Engineer Question 20
Select 3Google Cloud PlatformYour organization wants to automate the user lifecycle management process in Google Cloud to ensure that new users are provisioned with the correct permissions and deprovisioned automatically when they leave the organization. You are tasked with designing a solution that integrates with the organization's existing identity provider (IdP). Which steps should you take to implement this solution?
- A
Use Cloud Identity to sync user accounts from your organization's IdP and configure automated provisioning and deprovisioning.
- B
Manually create user accounts in IAM and assign roles based on a spreadsheet provided by the HR team.
- C
Enable the SCIM (System for Cross-domain Identity Management) API for your IdP and configure it to work with Cloud Identity.
- D
Set up Pub/Sub notifications for IAM role changes and write a custom script to manage user permissions.
- E
Configure a policy in Google Workspace to enforce role-based access control (RBAC) based on user attributes synchronized from your IdP.
Show answer and explanation
Correct answers: A, C, E
Explanation
Automating user lifecycle management in Google Cloud involves integrating with an organization's identity provider (IdP). By using Cloud Identity and enabling SCIM, you can synchronize user accounts and automate provisioning and deprovisioning. Configuring Google Workspace policies ensures access control is enforced dynamically based on user attributes, making the lifecycle process efficient and secure.
- A. Correct.
Correct: Cloud Identity provides a seamless integration with identity providers to sync user accounts and automate provisioning and deprovisioning.
- B. Incorrect.
Incorrect: Manual account creation is error-prone and does not scale. This approach is not suitable for automation.
- C. Correct.
Correct: SCIM is a standard protocol for automating user provisioning and deprovisioning between identity providers and service providers like Google Cloud.
- D. Incorrect.
Incorrect: Pub/Sub notifications and custom scripts are not a standard or recommended way to automate user lifecycle management. This method is complex and less reliable compared to built-in integrations.
- E. Correct.
Correct: Google Workspace policies can be configured to enforce RBAC using user attributes synchronized from an IdP, ensuring users are assigned roles dynamically based on their attributes.