Google Professional Cloud Security Engineer Question 6
Select 3Google Cloud PlatformYour organization uses Google Workspace for email and collaboration. You are tasked with managing user identities and ensuring security best practices for authentication. A recent security audit revealed the following issues: some users are not using multi-factor authentication (MFA), there are service accounts with excessive permissions, and multiple users have not been assigned roles following the principle of least privilege. Which actions should you take to address these issues?
- A
Enforce multi-factor authentication (MFA) for all users through a policy in Cloud Identity.
- B
Revoke all permissions from service accounts and delete them to prevent misuse.
- C
Review and update IAM roles for all users to align with the principle of least privilege.
- D
Enable Context-Aware Access to enforce conditional access based on user location and device.
- E
Use Google Cloud's Policy Analyzer to review and restrict excessive service account permissions.
Show answer and explanation
Correct answers: A, C, E
Explanation
To address the security audit findings, you should enforce MFA for all users to strengthen authentication, review and update IAM roles to follow the principle of least privilege, and use tools like Policy Analyzer to identify and minimize excessive service account permissions. These actions directly address the issues raised in the audit and follow Google Cloud security best practices.
- A. Correct.
This is correct. Enforcing MFA is a critical step in improving authentication security and is a best practice for managing identities in Google Cloud.
- B. Incorrect.
This is incorrect. While service accounts with excessive permissions are a concern, revoking all permissions and deleting them is not a practical solution. Instead, permissions should be reviewed and minimized.
- C. Correct.
This is correct. Aligning IAM roles with the principle of least privilege ensures users only have the permissions necessary for their tasks, reducing security risks.
- D. Incorrect.
This is incorrect. While Context-Aware Access adds an additional layer of security, it does not directly address the audit's findings related to MFA or IAM role management.
- E. Correct.
This is correct. The Policy Analyzer tool helps identify and restrict excessive permissions, particularly for service accounts, which is necessary to mitigate risks.