Google Professional Cloud Security Engineer Question 21
Select 3Google Cloud PlatformYour organization uses Google Workspace for identity management and Google Cloud for hosting workloads. You are tasked with automating the user lifecycle management process to ensure that new employees are provisioned with appropriate access and that departing employees have their access revoked promptly. Which of the following steps should you implement to achieve this?
- A
Integrate Google Workspace with an identity provider (IdP) that supports SCIM for automated user provisioning.
- B
Use Pub/Sub to trigger a Cloud Function that removes IAM roles when a user is marked as 'inactive' in Google Workspace.
- C
Configure Google Cloud Directory Sync (GCDS) to sync user accounts between Google Workspace and Active Directory.
- D
Implement a Cloud Run service that listens to Google Workspace webhooks for user lifecycle events and updates IAM policies.
- E
Manually review user accounts in IAM every 30 days and revoke unnecessary permissions.
Show answer and explanation
Correct answers: A, B, D
Explanation
To automate user lifecycle management, it’s essential to leverage identity provider integrations (e.g., SCIM), event-driven architectures (e.g., Pub/Sub and webhooks), and cloud-native services (e.g., Cloud Functions or Cloud Run) to ensure timely provisioning and deprovisioning of access. Manual processes or tools like GCDS that lack automation capabilities for lifecycle events are insufficient for this requirement.
- A. Correct.
Integrating Google Workspace with an identity provider (IdP) that supports SCIM (System for Cross-domain Identity Management) is a key step for automating user provisioning and deprovisioning based on lifecycle events.
- B. Correct.
Using Pub/Sub to trigger a Cloud Function can enable automated removal of IAM roles when a user is marked 'inactive', ensuring access is revoked promptly.
- C. Incorrect.
While Google Cloud Directory Sync (GCDS) can sync user accounts between Google Workspace and Active Directory, it does not provide full lifecycle automation for provisioning or deprovisioning users in Google Cloud.
- D. Correct.
Implementing a Cloud Run service to listen to Google Workspace webhooks for user lifecycle events allows real-time updates to IAM policies, which is critical for automation.
- E. Incorrect.
Manually reviewing user accounts every 30 days is not an automated solution and does not meet the requirements for lifecycle management automation.