A security engineer needs to configure a conditional IAM role binding for an external operations team in Google Cloud. The team requires administrative access to compute resources only during standard working business hours in Germany. The access must satisfy the following criteria: Access is permitted strictly from Monday through Friday. Access is permitted starting at 09:00:00 Central European Time (Europe/Berlin). Access must automatically terminate at 16:59:59 Central European Time (Europe/Berlin) so that no access is granted once the clock strikes 17:00:00. Which Common Expression Language (CEL) condition expression should the engineer bind to the IAM policy?

request.time.getHours("Europe/Berlin") >= 9 && request.time.getHours("Europe/Berlin") <= 16 && request.time.getDayOfWeek("Europe/Berlin") >= 1 && request.time.getDayOfWeek("Europe/Berlin") <= 5: ### What the CEL Expression Is This **Common Expression Language (CEL)** expression defines a recurring, time-based schedule condition evaluated dynamically against incoming API requests in Google Cloud IAM. ### How It Meets the Requirements - **Day-of-Week Constraint**: In CEL, `request.time.getDayOfWeek("Europe/Berlin")` returns an integer where `1` corresponds to Monday and `7` corresponds to Sunday. The clause `>= 1 && <= 5` restricts access strictly from **Monday through Friday**. - **Hour-of-Day Constraint**: In CEL, `request.time.getHours("Europe/Berlin")` returns an integer representing the hour in 24-hour notation (from `0` through `23`). The integer `16` represents the hour interval `16:00:00` through `16:59:59` (4:00 PM to 4:59 PM). Specifying `<= 16` guarantees that as soon as the time becomes `17:00:00`, the expression evaluates to `false`, revoking access immediately at 5:00 PM. - **Logical Conjunction**: The `&&` (AND) operators ensure that all criteria—valid days and valid hours in the designated timezone—must simultaneously be satisfied for the IAM role permissions to be granted. ### Key Advantages and Capabilities - **Dynamic attribute evaluation**: Evaluates access request timestamps in real time without requiring manual revoking of permissions. - **Timezone awareness**: Accurately computes daylight saving transitions using the IANA Time Zone database identifier (`Europe/Berlin`). - **Precise temporal boundary**: Enforces strict end-of-shift boundaries down to the second. ### Why This Is Optimal Using `request.time.getHours("Europe/Berlin") <= 16` correctly closes access at 4:59:59 PM, avoiding the common error of specifying `<= 17`, which would inadvertently allow access through 5:59:59 PM.

Iam Conditions Cel Schedule Hours | Professional Cloud Security Engineer

Iam Conditions Cel Schedule Hours

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A security engineer needs to configure a conditional IAM role binding for an external operations team in Google Cloud. The team requires administrative access to compute resources only during standard working business hours in Germany.

The access must satisfy the following criteria:

Access is permitted strictly from Monday through Friday.
Access is permitted starting at 09:00:00 Central European Time (Europe/Berlin).
Access must automatically terminate at 16:59:59 Central European Time (Europe/Berlin) so that no access is granted once the clock strikes 17:00:00.

Which Common Expression Language (CEL) condition expression should the engineer bind to the IAM policy?

request.time.getHours() >= 9 && request.time.getHours() <= 16 && request.time.getDayOfWeek() >= 1 && request.time.getDayOfWeek() <= 5

request.time.getHours("Europe/Berlin") >= 9 || request.time.getHours("Europe/Berlin") <= 16 || request.time.getDayOfWeek("Europe/Berlin") >= 1 || request.time.getDayOfWeek("Europe/Berlin") <= 5

request.time.getHours("Europe/Berlin") >= 9 && request.time.getHours("Europe/Berlin") <= 17 && request.time.getDayOfWeek("Europe/Berlin") >= 1 && request.time.getDayOfWeek("Europe/Berlin") <= 5

request.time.getHours("Europe/Berlin") >= 9 && request.time.getHours("Europe/Berlin") <= 16 && request.time.getDayOfWeek("Europe/Berlin") >= 1 && request.time.getDayOfWeek("Europe/Berlin") <= 5

Professional Cloud Security Engineer

Iam Conditions Cel Schedule Hours

Related questions