A security engineer must configure temporary, schedule-restricted access for a third-party security auditor in a specific Google Cloud project. The access policy must satisfy the following criteria: The auditor must be granted the Security Reviewer role (roles/iam.securityReviewer). Access must be restricted to standard working hours: Monday through Friday (Day 1 through Day 5), between 09:00 and 17:00 in the Europe/Berlin time zone. All access must automatically expire at midnight UTC on December 31, 2025 (2025-12-31T23:59:59Z). The policy must be applied programmatically using the Resource Manager API and Google Cloud CLI. Which Common Expression Language (CEL) IAM condition and policy structure should the security engineer implement?

Iam Conditional Bindings Cel Time Schedule | Professional Cloud Security Engineer

Iam Conditional Bindings Cel Time Schedule

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A security engineer must configure temporary, schedule-restricted access for a third-party security auditor in a specific Google Cloud project. The access policy must satisfy the following criteria:

The auditor must be granted the Security Reviewer role (roles/iam.securityReviewer).
Access must be restricted to standard working hours: Monday through Friday (Day 1 through Day 5), between 09:00 and 17:00 in the Europe/Berlin time zone.
All access must automatically expire at midnight UTC on December 31, 2025 (2025-12-31T23:59:59Z).
The policy must be applied programmatically using the Resource Manager API and Google Cloud CLI.

Which Common Expression Language (CEL) IAM condition and policy structure should the security engineer implement?

Set policy version: 3 and configure Privileged Access Manager (PAM) with a permanent role binding containing the CEL expression request.duration < duration('8h').

Set policy version: 1 and add a condition with the expression: request.time < timestamp('2025-12-31T23:59:59Z') && request.time.getHours('Europe/Berlin') >= 9 && request.time.getHours('Europe/Berlin') <= 17 && request.time.getDayOfWeek('Europe/Berlin') >= 1 && request.time.getDayOfWeek('Europe/Berlin') <= 5

Set policy version: 3 and add a condition with the expression: request.time < timestamp('2025-12-31T23:59:59Z') && request.time.getHours('Europe/Berlin') >= 9 && request.time.getHours('Europe/Berlin') <= 17 && request.time.getDayOfWeek('Europe/Berlin') >= 1 && request.time.getDayOfWeek('Europe/Berlin') <= 5

Set policy version: 3 and add a condition with the expression: resource.time < timestamp('2025-12-31T23:59:59Z') && resource.time.schedule('Europe/Berlin', 9, 17, [1,2,3,4,5])

Professional Cloud Security Engineer

Iam Conditional Bindings Cel Time Schedule

Related questions