An enterprise organization is establishing baseline authentication security controls across its Cloud Identity and Google Cloud environment. The security engineering team needs to enforce hardened authentication and recovery policies for privileged accounts (super administrators) while maintaining standard policies for general workforce users. Specifically, the implementation must achieve the following requirements: Super administrator identities must be isolated to apply targeted authentication policies. Privileged accounts must be protected against phishing attacks by enforcing hardware-backed 2-Step Verification (2SV). Privileged accounts must prevent unauthorized access through self-service recovery bypasses. Which configuration strategy should the security engineer implement in the Google Admin console?

Create a dedicated Organizational Unit (OU) for super administrator accounts, enforce 2-Step Verification requiring Security Keys only on that OU, and disable automated non-admin account recovery.: ### What this solution is This solution establishes a structured identity governance model in **Cloud Identity** by isolating privileged super administrator accounts into a dedicated **Organizational Unit (OU)**. By applying targeted policies to this OU, administrators can mandate hardware security keys (such as **Titan Security Keys**) for **2-Step Verification (2SV)** and restrict insecure self-service account recovery channels. ### How it meets the requirements - **Privileged Account Isolation**: Placing super administrators into a dedicated OU allows security teams to define granular, high-security policies that apply exclusively to privileged users without disrupting standard users across the organization. - **Phishing-Resistant 2-Step Verification**: Mandating **Security Keys only** (FIDO2/WebAuthn hardware tokens) ensures that second-factor authentication cannot be intercepted by man-in-the-middle or credential phishing attacks, satisfying **Google Control ID CI-CO-6.1** and **CI-CO-6.2**. - **Secure Account Recovery**: Disabling automated user self-service password recovery for the administrator OU ensures that an attacker cannot bypass strong 2SV requirements by compromising recovery email addresses or mobile phone numbers. ### Key advantages and capabilities - **Granular Policy Inheritance**: Cloud Identity applies organizational unit policies hierarchically, allowing distinct 2SV enforcement modes, grace periods, and credential restrictions across OUs. - **Cryptographic Protection**: Hardware keys provide cryptographic proof of domain binding, neutralizing sophisticated phishing and reverse-proxy attacks. - **Defense-in-Depth for Admins**: Protects the root of administrative trust across Google Cloud projects, Organization Policies, and resource hierarchies. - **Streamlined Auditing**: Grouping all super admin principals into a single OU simplifies periodic access certification and compliance reporting. ### Why this is optimal Isolating privileged identities into an administrative OU is the Google Cloud standard architecture for enforcing elevated controls. Applying FIDO2/Titan Security Key enforcement exclusively to this OU guarantees maximum identity assurance for privileged accounts while preventing account takeovers via legacy recovery mechanisms.

Cloud Identity Super Admin 2sv Enforcement 2 | Professional Cloud Security Engineer

Cloud Identity Super Admin 2sv Enforcement 2

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise organization is establishing baseline authentication security controls across its Cloud Identity and Google Cloud environment. The security engineering team needs to enforce hardened authentication and recovery policies for privileged accounts (super administrators) while maintaining standard policies for general workforce users.

Specifically, the implementation must achieve the following requirements:

Super administrator identities must be isolated to apply targeted authentication policies.
Privileged accounts must be protected against phishing attacks by enforcing hardware-backed 2-Step Verification (2SV).
Privileged accounts must prevent unauthorized access through self-service recovery bypasses.

Which configuration strategy should the security engineer implement in the Google Admin console?

Configure Workload Identity Federation with SAML 2.0 assertion encryption for all super administrators and grant them the Service Account Token Creator role on host project service accounts.

Keep all administrator and standard users in the root Organizational Unit (OU), configure global 2-Step Verification using SMS or voice codes, and enable automated email password recovery.

Use Policy Analyzer on the root organization node to enforce session expiration intervals, and configure automated OAuth client ID secret rotation every 24 hours.

Create a dedicated Organizational Unit (OU) for super administrator accounts, enforce 2-Step Verification requiring Security Keys only on that OU, and disable automated non-admin account recovery.

Professional Cloud Security Engineer

Cloud Identity Super Admin 2sv Enforcement 2

Related questions