Google Professional Cloud Security Engineer exam dumps

Google Professional Cloud Security Engineer practice question 29 of 501

Professional Cloud Security Engineer. Expert level, Google Cloud. Free question with the correct answer and a full explanation.

Google Professional Cloud Security Engineer Question 29

Select 3Google Cloud Platform

Your organization uses Google Cloud to manage infrastructure. You are tasked with programmatically managing user accounts and groups for a project. The security policy requires that you regularly audit group memberships and ensure that only specific roles can administer them. Which of the following steps should you take to meet this requirement?

  1. A

    Use the Cloud Identity Groups API to list group memberships.

  2. B

    Grant the roles/iam.securityAdmin role to all users in the project to manage group permissions.

  3. C

    Write a script using the Google Cloud SDK to periodically fetch and log group members for audit purposes.

  4. D

    Use the gcloud iam groups command to delete groups automatically when they are no longer needed.

  5. E

    Restrict permissions for managing groups by using IAM roles like roles/cloudidentity.groupAdmin.

Show answer and explanation

Correct answers: A, C, E

Explanation

To securely and programmatically manage user accounts and groups, the Cloud Identity Groups API should be used to list group memberships, and a script can automate periodic audits. Additionally, restricting administrative permissions to specific IAM roles like roles/cloudidentity.groupAdmin ensures adherence to the principle of least privilege, which is a key security best practice.

  • A. Correct.

    Correct: The Cloud Identity Groups API allows you to programmatically list and manage group memberships, making it an essential tool for auditing group membership.

  • B. Incorrect.

    Incorrect: Granting the roles/iam.securityAdmin role to all users violates the principle of least privilege and is not recommended for securing group management.

  • C. Correct.

    Correct: Automating the audit process with a script ensures that group memberships are regularly reviewed and logged for compliance purposes.

  • D. Incorrect.

    Incorrect: The gcloud iam groups command does not exist. Groups are managed using Cloud Identity APIs or the Admin Console.

  • E. Correct.

    Correct: Restricting permissions using IAM roles like roles/cloudidentity.groupAdmin ensures that only authorized users can manage groups, satisfying the security policy.

Timed practice exam

Take a Google Professional Cloud Security Engineer practice test under exam conditions

60 questions in 120 minutes, drawn from this bank, with a score report and a per-question review when you finish.

Start timed exam

More Google Professional Cloud Security Engineer practice questions

  1. 30.You are tasked with automating the management of user accounts and groups in your Google Cloud...
  2. 31.Your organization uses an external identity provider (IdP) to manage workforce identities and wants...
  3. 32.Your organization uses an external identity provider (IdP) for authentication and plans to enable...
  4. 33.Your organization uses an external identity provider (IdP) to manage employee authentication. You...
  5. 34.Your organization wants to allow its employees to access Google Cloud resources using their...
Back to the Google Professional Cloud Security Engineer exam dumps