Google Professional Cloud Security Engineer Question 96
Select 3Google Cloud PlatformYour organization wants to enable single sign-on (SSO) for accessing a third-party SaaS application using Google Cloud Identity. The SaaS application supports SAML-based authentication. As a Professional Cloud Security Engineer, what steps should you take to configure this integration securely?
- A
Configure a SAML Identity Provider (IdP) in Google Cloud Identity and provide the IdP metadata to the SaaS application.
- B
Obtain the SaaS application's SAML Service Provider (SP) metadata and configure it in Google Workspace.
- C
Enable OAuth 2.0 tokens to replace SAML assertions for authentication.
- D
Ensure that your Google Cloud Identity IdP is configured to use HTTPS for secure communication.
- E
Use OAuth 2.0 Client IDs instead of SAML configuration since OAuth is more secure for SSO.
Show answer and explanation
Correct answers: A, B, D
Explanation
To enable a secure SSO integration with a third-party SaaS application using SAML, you need to properly configure the SAML IdP in Google Cloud Identity, exchange metadata between the IdP and SP, and ensure secure communication through HTTPS. OAuth 2.0 is not applicable in this case, as the scenario explicitly requires SAML-based authentication for the SaaS application.
- A. Correct.
Correct: Configuring a SAML Identity Provider (IdP) in Google Cloud Identity and sharing its metadata with the SaaS application is a necessary step to establish trust between the IdP and the Service Provider (SP).
- B. Correct.
Correct: The SaaS application's SAML Service Provider (SP) metadata must be obtained and configured in Google Workspace to enable proper communication between the SP and the IdP.
- C. Incorrect.
Incorrect: OAuth 2.0 tokens and SAML are different protocols; they are not interchangeable. SAML assertions are used for SSO in this scenario, not OAuth tokens.
- D. Correct.
Correct: Configuring the Google Cloud Identity IdP to use HTTPS ensures secure communication between the IdP and SP. This is a fundamental security best practice.
- E. Incorrect.
Incorrect: While OAuth 2.0 is widely used, SAML is explicitly required in this scenario since the SaaS application supports SAML-based authentication and not OAuth.