A financial services organization is designing security controls for its production Google Cloud environment. To comply with regulatory standards and maintain strict separation of duties, the organization requires that: Sensitive administrative access is granted only on a temporary, just-in-time basis. Any elevated role activation requires explicit validation and approval from a distinct authorized entity before permissions take effect. All entitlement requests, approvals, and grant lifecycle events are systematically tracked through comprehensive audit logs for compliance review. Which solution should the cloud architect implement to meet these requirements?

Configure Privileged Access Manager (PAM) entitlements that require designated approvers for activation requests, and monitor grant lifecycle events using PAM audit logs integrated with Cloud Audit Logs.: ### What Privileged Access Manager (PAM) Is **Privileged Access Manager (PAM)** is a Google Cloud IAM service designed to manage just-in-time, temporary privilege escalation and multi-party approval workflows. PAM enables organizations to define entitlements for high-privilege roles without leaving standing administrative permissions active on resources. ### How It Meets the Requirements - **Multi-Party Authorization**: PAM allows administrators to configure approval workflows where temporary access requests must be reviewed and approved by designated, distinct approver identities or groups before permissions are granted. - **Separation of Duties**: Operational staff cannot grant themselves elevated access unilaterally; validation from an independent authority is strictly enforced. - **Comprehensive Audit Logging**: All entitlement configurations, grant requests, approval decisions, and activation events are automatically recorded in **Privileged Access Manager audit logs** and routed to **Cloud Audit Logs** (including Data Access audit logs where configured). ### Key Advantages and Capabilities - **Automated Revocation**: Grants expire automatically after a predefined maximum duration, mitigating privilege creep. - **Centralized Governance**: Enforces consistent authorization policies across organizations, folders, or specific projects. - **Native Integration**: Seamlessly interfaces with Cloud Audit Logs and Security Information and Event Management (SIEM) solutions for real-time compliance reporting. - **Granular Approver Groups**: Supports delegating approval authority to specific security or management teams. ### Why This Is Optimal Using native Google Cloud PAM provides built-in multi-party approval mechanisms paired with immutable, integrated Cloud Audit Logs. This avoids complex custom approval tooling while ensuring end-to-end accountability and rigorous separation of duties.

StudyCerts

Pam Multi Party Authorization Audit Logging | Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam! | StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Pam Multi Party Authorization Audit Logging

Section: Separation of duties

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A financial services organization is designing security controls for its production Google Cloud environment. To comply with regulatory standards and maintain strict separation of duties, the organization requires that:

Sensitive administrative access is granted only on a temporary, just-in-time basis.
Any elevated role activation requires explicit validation and approval from a distinct authorized entity before permissions take effect.
All entitlement requests, approvals, and grant lifecycle events are systematically tracked through comprehensive audit logs for compliance review.

Which solution should the cloud architect implement to meet these requirements?

Configure Privileged Access Manager (PAM) entitlements that require designated approvers for activation requests, and monitor grant lifecycle events using PAM audit logs integrated with Cloud Audit Logs.

Configure Linux auditd rules on Compute Engine instances to enforce mandatory access controls and require multi-party approval at the operating system kernel level.

Grant permanent administrative IAM roles directly to operations staff and configure Log Analytics queries on exported OS-level ADD_USER and ADD_GROUP event types.

Assign users the Organization Administrator role scoped by Access Context Manager IP conditions, and rely on Cloud Monitoring alerts for administrative activity.

Professional Cloud Architect

Pam Multi Party Authorization Audit Logging

Related questions