Google Professional Cloud Security Engineer Question 4
Select 3Google Cloud PlatformYour organization uses Google Workspace accounts for employees and has recently started using Google Cloud for its infrastructure. To ensure secure access management across the organization, you are tasked with setting up Cloud Identity. Which actions should you take to establish and manage Cloud Identity effectively while maintaining security best practices?
- A
Enable Cloud Identity and link it with your Google Workspace domain.
- B
Assign IAM roles directly to individual users for granular access control.
- C
Configure two-step verification for all users in Cloud Identity.
- D
Create a custom administrator role to delegate specific Cloud Identity management tasks.
- E
Disable automatic synchronization between Google Workspace and Cloud Identity.
Show answer and explanation
Correct answers: A, C, D
Explanation
To manage Cloud Identity effectively, you must ensure it is properly integrated with Google Workspace and implement security best practices. Enabling Cloud Identity and linking it to Google Workspace ensures seamless identity management. Configuring two-step verification protects user accounts from unauthorized access. Creating custom administrator roles promotes the principle of least privilege by allowing specific tasks to be delegated without granting excessive permissions. Avoid practices that compromise scalability or integration, such as assigning IAM roles directly to users or disabling synchronization between services.
- A. Correct.
Correct: Enabling Cloud Identity and linking it with your Google Workspace domain is a foundational step for managing identities and ensuring integration between the two services.
- B. Incorrect.
Incorrect: Assigning IAM roles directly to individual users is not a best practice. Instead, you should use groups for assigning roles to ensure scalability and easier management.
- C. Correct.
Correct: Configuring two-step verification enhances security by adding an additional layer of authentication for user accounts.
- D. Correct.
Correct: Creating a custom administrator role allows for delegation of specific tasks without granting broader administrative permissions, which aligns with the principle of least privilege.
- E. Incorrect.
Incorrect: Disabling automatic synchronization between Google Workspace and Cloud Identity would break the integration and could lead to mismanaged identities. Synchronization should remain enabled to streamline identity management.