A multinational enterprise is updating its security posture in Cloud Identity and Google Cloud to protect privileged administrative access. The security architecture team must establish stringent policies for Super Administrator accounts to prevent credential theft, phishing, and unauthorized privilege escalation. The policy must enforce the following security requirements: Super Administrator accounts must be protected with phishing-resistant multi-factor authentication. Administrators must not use Super Administrator privileges for day-to-day administrative operations. Persistent trusted sessions that bypass multi-factor authentication challenges must be prohibited. All privileged administrative actions must be fully traceable to individual identities. Which set of controls should the organization implement?

Place Super Administrator accounts in a dedicated Organizational Unit (OU) enforcing 2-Step Verification with Security Keys only, disable the 'Allow user to trust the device' setting, assign pre-built or custom administrative roles to separate daily accounts, and enable administrative audit logging.: ### What the Recommended Architecture Is This solution establishes a defense-in-depth security model for **Cloud Identity Super Administrator accounts** by isolating high-privilege identities into a dedicated **Organizational Unit (OU)**. Within this OU, strict identity verification policies, session constraints, and role-delegation rules are uniformly applied. ### How It Meets the Security Requirements - **Phishing-Resistant MFA**: Restricting the **2-Step Verification (2SV)** method exclusively to **physical Security Keys (FIDO2/WebAuthn)** neutralizes phishing, credential replay, and man-in-the-middle (MitM) attacks. - **Least Privilege and Role Delegation**: Daily operations are conducted using standard accounts provisioned with **pre-built administrative roles** or granular **custom administrator roles**, eliminating the need for daily Super Admin usage. - **Session Integrity**: Disabling the **'Allow user to trust the device'** setting prevents long-lived cookies from bypassing step-up verification prompts across administrative sessions. - **Accountability & Traceability**: Each administrator receives a named, dedicated account rather than sharing credentials, ensuring all operations recorded in **Cloud Audit Logs** and **Admin Console Audit Logs** provide non-repudiation. ### Key Advantages - **Phishing Immunity**: FIDO-compliant hardware keys cryptographically bind authentication to the specific origin URL, thwarting reverse-proxy phishing attacks. - **Reduced Blast Radius**: Segregating daily tasks prevents accidental destructive changes or widespread compromise from compromised developer workstations. - **Comprehensive Audit Visibility**: Facilitates real-time anomaly detection and SIEM ingestion of administrative activities. - **Granular Policy Application**: Utilizing a dedicated OU allows applying strict authentication and session duration rules without impacting regular business users. ### Why This Is Optimal Isolating Super Admin accounts into their own organizational unit with mandatory hardware security keys and delegated least-privilege roles directly enforces Google Cloud security best practices, eliminating shared account vulnerabilities and credential persistence risks.

Super Admin Account Security Controls | Professional Cloud Security Engineer

Super Admin Account Security Controls

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A multinational enterprise is updating its security posture in Cloud Identity and Google Cloud to protect privileged administrative access. The security architecture team must establish stringent policies for Super Administrator accounts to prevent credential theft, phishing, and unauthorized privilege escalation.

The policy must enforce the following security requirements:

Super Administrator accounts must be protected with phishing-resistant multi-factor authentication.
Administrators must not use Super Administrator privileges for day-to-day administrative operations.
Persistent trusted sessions that bypass multi-factor authentication challenges must be prohibited.
All privileged administrative actions must be fully traceable to individual identities.

Which set of controls should the organization implement?

...

Configure Single Sign-On (SSO) with a third-party Identity Provider for Super Administrator accounts, allow SMS-based verification as a backup method, and grant all senior engineers the Super Administrator role to ensure continuous operational coverage.

...

Assign Super Administrator privileges directly to primary corporate email accounts, enable Google Prompt on personal mobile devices, and extend session lengths to 30 days with device trusting enabled to prevent frequent re-authentication.

...

Deploy a single shared break-glass Super Administrator account with a rotating static password, disable multi-factor authentication to avoid device lockouts, and restrict access exclusively using IP-based VPC Service Controls.

...

Place Super Administrator accounts in a dedicated Organizational Unit (OU) enforcing 2-Step Verification with Security Keys only, disable the 'Allow user to trust the device' setting, assign pre-built or custom administrative roles to separate daily accounts, and enable administrative audit logging.

...

Professional Cloud Security Engineer

Super Admin Account Security Controls

Related questions

Ask Scout