An enterprise organization wants to implement a just-in-time (JIT) privileged access strategy for its site reliability engineering (SRE) team on a production folder in Google Cloud. The security solution must satisfy the following operational and compliance requirements: SREs must request temporary administrative access on demand rather than holding permanent privileges. Every elevation request must enforce a mandatory business justification and require explicit approval from designated lead engineers. Elevated privileges must automatically expire and be revoked after a defined maximum duration. All entitlement requests, approvals, justifications, and active access periods must be captured in Cloud Audit Logs. Which solution should the organization implement?

Create Privileged Access Manager (PAM) entitlements at the folder level configured with the SREs as eligible requesters, designated lead engineers as approvers, mandatory justification, the required elevated IAM roles, and a maximum grant duration.: ### What Privileged Access Manager (PAM) is **Privileged Access Manager (PAM)** is a Google Cloud-native service designed to manage, automate, and audit just-in-time (JIT) temporary privilege elevation for users and service accounts across organizations, folders, and projects. ### How it meets the requirements - **On-demand JIT access**: Eligible SRE principals are defined as requesters within the **PAM entitlement**, enabling them to request temporary grants only when operational needs arise rather than possessing persistent standing permissions. - **Approval workflow and justification**: Entitlements can enforce mandatory business justifications for requesters and mandate explicit multi-party approval workflows where designated approvers (such as lead engineers) must review and approve or deny grant requests. - **Automatic revocation and time-bound access**: The entitlement enforces a maximum grant duration. Once an approved grant expires, PAM automatically revokes the temporary IAM role bindings without requiring manual intervention. - **Comprehensive audit logging**: PAM natively generates structured **Cloud Audit Logs** for every stage of the lifecycle, including grant requests, justifications, approval/denial decisions, grant activations, and automated revocations. ### Key advantages and capabilities - **Granular scoping**: Supports role bindings with tag-based and resource-level **IAM Conditions** for precise least-privilege scoping. - **Automated lifecycle**: Eliminates operational overhead and human error associated with manually granting and removing privileges. - **Enterprise integration**: Supports email and Pub/Sub notifications for alerting stakeholders and integrating with ITSM ticketing platforms. - **Multi-level approval support**: Offers multi-party and multi-level approval configurations to mitigate insider threats. ### Why this is optimal Native PAM entitlements provide an automated, policy-driven, and fully audited framework for temporary privilege escalation, eliminating custom script maintenance, API rate-limit concerns, and standing privilege risks.

Privileged Access Manager Jit Entitlements | Professional Cloud Security Engineer

Privileged Access Manager Jit Entitlements

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise organization wants to implement a just-in-time (JIT) privileged access strategy for its site reliability engineering (SRE) team on a production folder in Google Cloud.

The security solution must satisfy the following operational and compliance requirements:

SREs must request temporary administrative access on demand rather than holding permanent privileges.
Every elevation request must enforce a mandatory business justification and require explicit approval from designated lead engineers.
Elevated privileges must automatically expire and be revoked after a defined maximum duration.
All entitlement requests, approvals, justifications, and active access periods must be captured in Cloud Audit Logs.

Which solution should the organization implement?

Grant permanent conditional IAM role bindings directly in the folder allow policy using CEL expressions with request.time < timestamp(...) that are updated by manual administrative intervention during incidents.

Enable Access Approval on the folder and configure lead engineers as approval contacts to validate individual administrative API requests submitted by SREs.

Assign the elevated IAM roles to a Google Group at the folder level, and deploy a custom Cloud Function that adds and removes users from the Google Group upon ticket approval.

Create Privileged Access Manager (PAM) entitlements at the folder level configured with the SREs as eligible requesters, designated lead engineers as approvers, mandatory justification, the required elevated IAM roles, and a maximum grant duration.

Professional Cloud Security Engineer

Privileged Access Manager Jit Entitlements

Related questions