An enterprise organization is hardening its Google Cloud and Cloud Identity access governance model. A security audit reveals that several administrators hold permanent Super Admin privileges for day-to-day administrative tasks, creating critical risks of configuration tampering, accidental service disruption, and broad privilege abuse. The security team must implement a robust access control architecture meeting these requirements: Eliminate standing super administrator assignments by enforcing least privilege and separation of duties for daily operations. Provide an audited break-glass emergency procedure for critical Cloud Identity recovery scenarios with controls to prevent unilateral unauthorized activation. Provide time-bound, just-in-time (JIT) privilege elevation with mandatory business justifications and audit logging for sensitive infrastructure administration. Which set of controls should the organization implement?

Assign granular pre-built or custom administrative roles for daily administrative tasks; configure Privileged Access Manager (PAM) entitlements with time-bound grants and mandatory justification for infrastructure privilege elevation; maintain dedicated, non-federated break-glass super admin accounts protected by split operations and monitored via automated security alerts.: ### What the Recommended Architecture Is This architecture combines **least-privilege role segregation**, **just-in-time (JIT) privileged access management**, and **governed break-glass procedures** to eliminate standing super administrator accounts while preserving operational continuity. ### How It Meets the Requirements - **Eliminating standing privileges through separation of duties:** Replacing standing super administrator assignments with **pre-built administrative roles** (such as User Management Admin or Help Desk Admin) and **custom IAM roles** ensures staff only have the specific permissions required for daily tasks. - **Governed break-glass access:** Establishing dedicated, separate break-glass emergency accounts (e.g., `admin-breakglass@example.com`) ensures emergency recovery if identity federation fails. Enforcing **split operations** (where one individual holds the credentials and another holds the hardware MFA token or approval authority) prevents unilateral account abuse. - **Time-bound elevation and auditing:** Using **Privileged Access Manager (PAM)** enables users to request temporary, time-bound grants against entitlements that require explicit business justifications, automated approvals, and detailed audit logging in Cloud Logging and Security Command Center. ### Key Advantages and Capabilities - **Attack Surface Minimization:** Prevents continuous privilege exposure and limits the blast radius of compromised credentials. - **Multi-Party Governance:** Prevents insider threats or single compromised identities from executing unilateral enterprise-wide modifications. - **Automated Lifecycle Controls:** Automatically revokes elevated access after the configured duration expires, eliminating orphaned permissions. - **Comprehensive Traceability:** Captures end-to-end audit logs of who requested access, the justification provided, who approved it, and what actions were performed. ### Why This Is Optimal This solution directly implements cloud security best practices by decoupling everyday administrative responsibilities from super admin access, establishing dual-control emergency recovery paths, and enforcing temporary elevation via Privileged Access Manager.

Mitigate Super Admin Privileged Access Risks | Professional Cloud Security Engineer

Mitigate Super Admin Privileged Access Risks

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise organization is hardening its Google Cloud and Cloud Identity access governance model. A security audit reveals that several administrators hold permanent Super Admin privileges for day-to-day administrative tasks, creating critical risks of configuration tampering, accidental service disruption, and broad privilege abuse.

The security team must implement a robust access control architecture meeting these requirements:

Eliminate standing super administrator assignments by enforcing least privilege and separation of duties for daily operations.
Provide an audited break-glass emergency procedure for critical Cloud Identity recovery scenarios with controls to prevent unilateral unauthorized activation.
Provide time-bound, just-in-time (JIT) privilege elevation with mandatory business justifications and audit logging for sensitive infrastructure administration.

Which set of controls should the organization implement?

Enforce Single Sign-On (SSO) with an external IdP for all super admin accounts; configure IAM session length policies to 1 hour; grant permanent Organization Administrator roles to the primary administrative user accounts.

Assign granular pre-built or custom administrative roles for daily administrative tasks; configure Privileged Access Manager (PAM) entitlements with time-bound grants and mandatory justification for infrastructure privilege elevation; maintain dedicated, non-federated break-glass super admin accounts protected by split operations and monitored via automated security alerts.

Disable service account key creation across the organization; enforce OS Login with two-step verification for all Compute Engine instances; configure Chrome Enterprise Premium certificate-based access for the super admin accounts.

Configure domain-wide delegation for all administrator accounts to impersonate the super administrator identity; use Cloud Functions to automatically disable the accounts after 8 hours; enable basic audit logging on the organization root node.

Professional Cloud Security Engineer

Mitigate Super Admin Privileged Access Risks

Related questions