A financial services organization federates its workforce identity architecture with Cloud Identity and manages access across multiple Google Cloud projects using group-based IAM bindings. The security team must implement a group lifecycle and access governance strategy that satisfies the following requirements: Automated Membership Lifecycle: Automatically provision and deprovision users from Google Groups as employee job roles and department attributes change. Synchronization Integrity: Prevent group managers and standard users from manually adding or removing members in the console, ensuring the group remains strictly synchronized with organizational rules. Access Review and Rightsizing: Periodically analyze, review, and rightsize IAM role grants at an enterprise scale to identify and remove unused permissions. Which combination of Google Cloud identity and governance capabilities should the organization implement?

Configure Dynamic groups based on employee attribute queries, lock the groups to prevent manual membership tampering, and configure BigQuery Data Transfer Service to export IAM recommendations to BigQuery for automated access reviews.: ### What the Solution Is **Dynamic groups** in Cloud Identity, combined with **locked group** security controls and **IAM Recommender export to BigQuery**, provide an automated, tamper-resistant group lifecycle and access review architecture. ### How It Meets the Requirements - **Automated Membership Lifecycle:** **Dynamic groups** automatically manage user inclusion and removal by continuously evaluating membership queries against employee attributes (such as `jobTitle`, `department`, or location) synced from the primary identity system. - **Synchronization Integrity:** Enabling **locked group** settings restricts group attribute and membership modifications strictly to authorized administrators (such as `Groups Admin`), preventing local group owners, managers, or members from manually altering memberships and causing configuration drift from the source of truth. - **Access Review and Rightsizing:** Configuring the **BigQuery Data Transfer Service** to export **IAM Recommender** insights and `REMOVE_ROLE` recommendations allows security teams to query, aggregate, and review unused privileges and access across all folders and projects at an enterprise scale. ### Key Advantages and Capabilities - **Zero-Touch Deprovisioning:** Automatically revokes access to cloud resources the moment an employee changes department or leaves their role. - **Centralized Governance:** Eliminates synchronization drift caused by manual intervention in Google Groups. - **Enterprise Scale Analysis:** Uses BigQuery SQL queries and visualization tools (like Looker Studio) to systematically track and remediate stale IAM bindings. - **Least Privilege Enforcement:** Continuously aligns granted permissions with actual usage patterns detected by machine learning models. ### Why This Is Optimal This architecture completely eliminates manual provisioning overhead, enforces strict group integrity, and automates periodic access reviews using native Google Cloud Policy Intelligence and Cloud Identity capabilities.

Group Lifecycle Dynamic Locked Recommender | Professional Cloud Security Engineer

Group Lifecycle Dynamic Locked Recommender

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A financial services organization federates its workforce identity architecture with Cloud Identity and manages access across multiple Google Cloud projects using group-based IAM bindings. The security team must implement a group lifecycle and access governance strategy that satisfies the following requirements:

Automated Membership Lifecycle: Automatically provision and deprovision users from Google Groups as employee job roles and department attributes change.
Synchronization Integrity: Prevent group managers and standard users from manually adding or removing members in the console, ensuring the group remains strictly synchronized with organizational rules.
Access Review and Rightsizing: Periodically analyze, review, and rightsize IAM role grants at an enterprise scale to identify and remove unused permissions.

Which combination of Google Cloud identity and governance capabilities should the organization implement?

Create standard Google Groups with manual access request approvals, configure Identity-Aware Proxy (IAP) access locks, and monitor membership change events in Cloud Logging.

Deploy Identity Platform multi-tenant user pools, implement custom claims for group validation, and configure Cloud Storage Bucket Lock on exported access logs.

Configure Dynamic groups based on employee attribute queries, lock the groups to prevent manual membership tampering, and configure BigQuery Data Transfer Service to export IAM recommendations to BigQuery for automated access reviews.

Configure POSIX groups with OS Login metadata, apply VPC Service Controls perimeters around the groups, and run Policy Analyzer queries filtered on network tags.

Professional Cloud Security Engineer

Group Lifecycle Dynamic Locked Recommender

Related questions