Google Professional Cloud Security Engineer Question 87
Select 3Google Cloud PlatformYou are designing authentication for a Google Cloud project that hosts sensitive financial data. The organization requires strong identity verification, minimal disruption to user workflows, and wants to reduce the risks associated with credential theft. Which of the following authentication mechanisms should you implement to meet these requirements?
- A
Enable Multi-Factor Authentication (MFA) using Google Authenticator or FIDO2 security keys.
- B
Use service account keys for all user authentication to simplify access management.
- C
Integrate Google Cloud Identity with your organization's SAML-based single sign-on (SSO) solution.
- D
Configure OAuth 2.0 tokens with long expiration periods for convenience.
- E
Enable context-aware access policies to enforce access controls based on user device and location.
- F
Rely solely on passwords and enforce regular password rotation policies.
Show answer and explanation
Correct answers: A, C, E
Explanation
To secure sensitive financial data in Google Cloud, it is critical to use robust authentication mechanisms that go beyond password-based approaches. Multi-Factor Authentication (MFA) significantly reduces the risks of credential theft. Integration with SAML-based SSO ensures strong identity verification while streamlining the user experience. Context-aware access adds granular security controls based on real-time user and device context. These measures collectively provide a balance between security and user convenience.
- A. Correct.
Multi-Factor Authentication (MFA) enhances security by requiring multiple forms of verification, such as something the user knows (password) and something the user has (security key). This reduces risks associated with stolen passwords.
- B. Incorrect.
Service account keys are intended for non-human workloads, not user authentication. Using them for user authentication is a security anti-pattern and is not recommended.
- C. Correct.
Integrating with SAML-based single sign-on (SSO) solutions provides a seamless user experience while maintaining a centralized and secure authentication mechanism.
- D. Incorrect.
OAuth 2.0 tokens with long expiration periods can pose a security risk if compromised, as they allow prolonged access without re-verification.
- E. Correct.
Context-aware access policies provide an additional layer of security by enforcing access controls based on user attributes such as device security status or geographic location.
- F. Incorrect.
Relying solely on passwords, even with regular rotation, is insufficient for securing sensitive data due to risks like phishing and credential stuffing attacks.