A financial enterprise is designing an authorization model in Google Cloud to meet strict compliance mandates for privileged activity logging, emergency break-glass procedures, and separation of duties across production environments. The security architecture team has defined the following requirements: On-call Site Reliability Engineers (SREs) must maintain zero standing administrative permissions during normal operations but need immediate, self-service elevation during critical production outages without waiting for human approval. Database administrators (DBAs) requiring elevated permissions to perform scheduled schema updates on production databases containing sensitive customer data must submit a business justification and obtain explicit authorization from security managers. All elevated privileges must automatically expire after a predefined duration, provide full audit logs capturing when access was active, and track who approved or requested each escalation. Which authorization strategy should the security engineer implement to satisfy these requirements?

Create two Privileged Access Manager (PAM) entitlements: one with pre-configured approval bypass and mandatory justification for on-call SREs, and one requiring explicit multi-party approval with business justification for DBAs.: ### What Privileged Access Manager (PAM) is **Privileged Access Manager (PAM)** is a Google Cloud service designed to implement **just-in-time (JIT)**, time-bound privilege elevation with integrated approval workflows, justification enforcement, and comprehensive audit trails. ### How it meets the requirements: - **Emergency Break-Glass Access**: PAM allows entitlements to be configured without requiring approval (`approval from a select set of principals` is optional), allowing authorized SREs to request and immediately activate emergency access while still requiring an operational justification for post-incident auditability. - **Controlled Access to Sensitive Data**: Entitlements for DBAs can enforce mandatory approvals from designated security managers alongside detailed business justifications before permissions are granted. - **Time-Bound Enforcement and Automatic Revocation**: Grants issued against PAM entitlements automatically expire after the configured maximum duration, removing the elevated roles seamlessly. - **Compliance and Audit Trails**: PAM generates comprehensive audit logs recording who requested access, what justification was supplied, who approved the grant, and the exact timestamps when access was active. ### Key advantages: - **Granular Least Privilege**: Eliminates standing administrative access across production environments. - **Separation of Duties**: Decouples role requesters from role approvers, satisfying strict compliance frameworks. - **Scope Customization & Withdrawal**: Requesters can request customized scopes or withdraw grants immediately upon task completion. - **Automated Revocation**: Automatically cleans up temporary IAM role bindings after the grant duration lapses. ### Why this is optimal: - PAM natively fulfills both auto-approved break-glass workflows and multi-party approval workflows while capturing end-to-end audit metadata for compliance.

Pam Use Cases Jit Break Glass Approvals | Professional Cloud Security Engineer

Pam Use Cases Jit Break Glass Approvals

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A financial enterprise is designing an authorization model in Google Cloud to meet strict compliance mandates for privileged activity logging, emergency break-glass procedures, and separation of duties across production environments.

The security architecture team has defined the following requirements:

On-call Site Reliability Engineers (SREs) must maintain zero standing administrative permissions during normal operations but need immediate, self-service elevation during critical production outages without waiting for human approval.
Database administrators (DBAs) requiring elevated permissions to perform scheduled schema updates on production databases containing sensitive customer data must submit a business justification and obtain explicit authorization from security managers.
All elevated privileges must automatically expire after a predefined duration, provide full audit logs capturing when access was active, and track who approved or requested each escalation.

Which authorization strategy should the security engineer implement to satisfy these requirements?

Assign permanent least-privilege roles to SREs and DBAs, and instruct them to impersonate predefined Service Accounts that hold administrative roles whenever they need elevated access.

Create Google Groups for SREs and DBAs with permanent administrative roles bound at the project level, and use Cloud Functions triggered by Cloud Audit Logs to remove group members after two hours.

Create two Privileged Access Manager (PAM) entitlements: one with pre-configured approval bypass and mandatory justification for on-call SREs, and one requiring explicit multi-party approval with business justification for DBAs.

Configure standard IAM role bindings with IAM Conditions based on request time windows (request.time) for SREs and DBAs, and grant DBAs the Security Admin role to update their own IAM bindings when maintenance begins.

Professional Cloud Security Engineer

Pam Use Cases Jit Break Glass Approvals

Related questions