A security operations center (SOC) detects that an attacker compromised a developer's workstation and exfiltrated active gcloud CLI OAuth tokens to an external host to execute unauthorized Google Cloud API requests. The organization uses Cloud Identity federated with an external Identity Provider (IdP) using SAML 2.0 for Single Sign-On (SSO). The security team needs to achieve the following: Immediately terminate the attacker's ability to use the stolen gcloud CLI access and refresh tokens. Enforce time-bound session controls across both the Google Cloud console and the gcloud CLI. Prevent silent re-authentication at the end of each session period so that users must re-enter credentials and complete multi-factor authentication (MFA). Which set of actions should the security team take?

Remove the gcloud CLI (Google Cloud SDK) from the user's connected applications, configure Google Cloud session control to require re-authentication (1–24 hours), and set the external IdP session duration to be shorter than the Google Cloud session length.: ### What the solution is This remediation and hardening strategy combines **OAuth token revocation** via connected application management with **Google Cloud session control** and **Identity Provider (IdP) session alignment** to eliminate compromised credentials and enforce periodic re-authentication. ### How it meets the requirements - **Immediate Token Invalidation:** Revoking the **Google Cloud SDK** from the user's list of connected applications immediately invalidates active OAuth 2.0 access tokens and long-lived refresh tokens across Google's authorization servers, preventing the attacker from continuing to make requests from external hosts. - **Unified Session Limits:** Configuring the dedicated **Google Cloud session control** setting in Cloud Identity / Google Workspace establishes a strict re-authentication period (between 1 and 24 hours) that governs both the **Google Cloud console** and command-line interfaces such as the **gcloud CLI**. - **Preventing Silent Re-authentication:** When an external SAML IdP session outlasts Google's session timeout, users are seamlessly re-authenticated upon redirection without entering credentials. Setting the **external IdP session length shorter than the Google Cloud session length** ensures that once the Google Cloud session expires, the IdP forces full credential re-entry and secondary MFA challenges. ### Key advantages and capabilities - **Targeted OAuth Revocation:** Invalidates API bearer tokens without requiring account deletion or disrupting non-CLI directory assets. - **Dual-Interface Enforcement:** Enforces session timeouts equally on browser sessions and SDK programmatic tokens. - **True Zero Trust Re-authentication:** Mitigates credential reuse by blocking automatic SAML assertion refreshes at the identity layer. - **Auditable Lifecycle Management:** Token revocations and session expirations produce structured audit logs in Cloud Audit Logs and the Admin Console. ### Why this is optimal Alternative measures—such as resetting account passwords or web sign-in cookies—do not invalidate existing OAuth access tokens that an attacker has already copied. Aligning IdP session lengths with Google Cloud re-authentication policies guarantees that session terminations enforce actual user challenges rather than silent automated renewals.

Manage Gcloud Oauth Tokens Session Control | Professional Cloud Security Engineer

Manage Gcloud Oauth Tokens Session Control

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A security operations center (SOC) detects that an attacker compromised a developer's workstation and exfiltrated active gcloud CLI OAuth tokens to an external host to execute unauthorized Google Cloud API requests. The organization uses Cloud Identity federated with an external Identity Provider (IdP) using SAML 2.0 for Single Sign-On (SSO).

The security team needs to achieve the following:

Immediately terminate the attacker's ability to use the stolen gcloud CLI access and refresh tokens.
Enforce time-bound session controls across both the Google Cloud console and the gcloud CLI.
Prevent silent re-authentication at the end of each session period so that users must re-enter credentials and complete multi-factor authentication (MFA).

Which set of actions should the security team take?

Suspend the compromised user account in Cloud Identity, configure a VPC Service Controls perimeter around the Developer project, and set the external IdP session length to 24 hours while setting Google Cloud session length to 8 hours.

Run gcloud auth revoke locally on the developer's machine, apply the iam.allowedPolicyMemberDomains organization policy, and configure network masks within Cloud Identity single sign-on settings.

Reset the user's password, reset their sign-in cookies in the Admin Console, configure the session length for Google services to 8 hours, and enable OS Login 2FA across all Compute Engine projects.

Remove the gcloud CLI (Google Cloud SDK) from the user's connected applications, configure Google Cloud session control to require re-authentication (1–24 hours), and set the external IdP session duration to be shorter than the Google Cloud session length.

Professional Cloud Security Engineer

Manage Gcloud Oauth Tokens Session Control

Related questions