Google Professional Cloud Security Engineer Question 3
Select 3Google Cloud PlatformYour organization is using Google Cloud and has implemented Cloud Identity to manage user accounts and access. A security audit has revealed that some users have been granted excessive permissions, which violates the principle of least privilege. As a Professional Cloud Security Engineer, what steps should you take to align with best practices for managing Cloud Identity?
- A
Review and audit current IAM roles assigned to users and remove unnecessary permissions.
- B
Grant all users the Owner role at the project level to ensure they can perform any required action.
- C
Enable and configure Google Workspace Directory Sync to ensure user accounts are synchronized with your on-premises directory.
- D
Implement groups in Cloud Identity to manage permissions collectively rather than assigning roles to individual users.
- E
Set up custom roles to provide only the specific permissions needed for user tasks.
Show answer and explanation
Correct answers: A, D, E
Explanation
To manage Cloud Identity effectively and enforce the principle of least privilege, it is essential to audit IAM roles and remove unnecessary permissions. Group-based management simplifies permission handling and ensures consistency, while custom roles allow for fine-grained access control tailored to specific needs. Granting excessive permissions, such as the Owner role, or relying solely on directory synchronization does not align with security best practices.
- A. Correct.
Correct. Regularly auditing IAM roles and removing unnecessary permissions is a key step in maintaining secure and compliant access control.
- B. Incorrect.
Incorrect. Granting the Owner role to all users violates the principle of least privilege and exposes your environment to significant security risks.
- C. Incorrect.
Incorrect. While enabling synchronization through Google Workspace Directory Sync can help manage user accounts, it does not address excessive permissions directly.
- D. Correct.
Correct. Using groups allows you to manage permissions at a group level, making it easier to ensure consistency and reduce the risk of over-permissioning.
- E. Correct.
Correct. Custom roles enable you to tailor permissions to meet the specific needs of users, ensuring they have only the access they require.