Google Professional Cloud Security Engineer Question 88
Select 3Google Cloud PlatformYour organization is using Google Cloud and wants to implement a secure authentication mechanism for its employees to access resources. The organization has a hybrid environment where some resources are on-premises, and others are in Google Cloud. The security team decides to enforce single sign-on (SSO) and multi-factor authentication (MFA) for all users. Which steps should you take to achieve this?
- A
Integrate Google Cloud Identity with the existing on-premises identity provider (IdP) to support SSO.
- B
Enable multi-factor authentication (MFA) using Google Cloud's built-in Identity Platform.
- C
Configure conditional access policies to enforce MFA based on resource sensitivity or user behavior.
- D
Disable OAuth 2.0 to restrict third-party application integrations and increase security.
- E
Use a third-party MFA solution that integrates with Google Workspace and Cloud Identity.
Show answer and explanation
Correct answers: A, C, E
Explanation
To securely manage authentication in a hybrid environment, you should integrate Google Cloud Identity with your existing on-premises IdP to support SSO, enforce conditional access policies for MFA based on specific conditions, and optionally use a third-party MFA solution to enhance security. Using the Identity Platform for MFA or disabling OAuth 2.0 are not appropriate solutions in this scenario.
- A. Correct.
Integrating Google Cloud Identity with the on-premises IdP ensures that employees can use SSO for seamless access to both on-premises and cloud-based resources.
- B. Incorrect.
While enabling MFA is a good practice, the Identity Platform is mainly for customer authentication, not enterprise employee authentication. Google Cloud Identity or Workspace should be used instead.
- C. Correct.
Conditional access policies provide an additional layer of security by enforcing MFA or other requirements based on specific conditions like user behavior or resource sensitivity.
- D. Incorrect.
Disabling OAuth 2.0 is not recommended as it is a standard protocol for secure authorization. Instead, OAuth 2.0 can be configured securely to integrate applications.
- E. Correct.
Using a third-party MFA solution that integrates with Google Workspace and Cloud Identity can provide flexibility and advanced features for enterprise security.