Pam Entitlements Event Threat Detection Dormant Accounts

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A financial enterprise is updating its identity governance and privilege escalation policies across several Google Cloud production projects. The security team wants to eliminate permanent administrative role bindings, establish automated justification and approval workflows for time-bound access elevations integrated with their ITSM platform, and automatically detect when dormant service accounts are granted unauthorized impersonation roles.

Which combination of Google Cloud features should the security engineer implement to satisfy these requirements?

Configure Policy Troubleshooter automated remediation rules; implement Principal Access Boundary policies to restrict dormant service account delegation chains across projects.

Enforce OS Login with 2-step verification across all Compute Engine instances; configure Organization Policies with iam.disableServiceAccountKeyCreation and automated Cloud KMS key rotation.

Implement Access Context Manager conditional levels with Chrome Enterprise Premium user-risk policies; configure VPC Service Controls perimeters and rely on custom Cloud Functions parsing Cloud Logging export sinks.

Configure Privileged Access Manager (PAM) entitlements requiring justification and automated service account approvers for ITSM integration; monitor Security Command Center Event Threat Detection for dormant service account impersonation findings and apply IAM Recommender recommendations.

Professional Cloud Security Engineer

Pam Entitlements Event Threat Detection Dormant Accounts

Related questions