Google Professional Cloud Security Engineer Question 33
Select 4Google Cloud PlatformYour organization uses an external identity provider (IdP) to manage employee authentication. You need to configure Workforce Identity Federation on Google Cloud to allow employees to access Google Cloud resources without creating Google Cloud IAM users. Which of the following steps are required to properly configure Workforce Identity Federation?
- A
Create an identity provider in Google Cloud using the configuration details of the external IdP.
- B
Enable the 'Allow All OAuth Scopes' option to grant broad access to Google Cloud resources.
- C
Add a workload identity pool and configure the external IdP with the pool ID.
- D
Map external identities to Google Cloud roles by creating an IAM policy binding.
- E
Configure the external IdP to issue tokens compatible with Google's token exchange endpoint.
Show answer and explanation
Correct answers: A, C, D, E
Explanation
To configure Workforce Identity Federation, you must establish trust between Google Cloud and the external IdP by creating an identity provider and configuring a workload identity pool. You also need to map external identities to specific Google Cloud roles using IAM policy bindings. Additionally, the external IdP must issue tokens that are compatible with Google's token exchange endpoint. Enabling 'Allow All OAuth Scopes' is not recommended as it unnecessarily broadens access and violates security best practices.
- A. Correct.
Correct: You need to create an identity provider in Google Cloud to establish trust between the external IdP and Google Cloud, enabling token exchange.
- B. Incorrect.
Incorrect: 'Allow All OAuth Scopes' is not a recommended or required step, as it goes against the principle of least privilege.
- C. Correct.
Correct: A workload identity pool is required to group identities from the external IdP and manage access to Google Cloud resources.
- D. Correct.
Correct: Mapping external identities to Google Cloud roles via IAM policy bindings allows you to define the permissions external users will have.
- E. Correct.
Correct: The external IdP must issue tokens that comply with Google's token exchange endpoint requirements so that the authentication process can succeed.