Troubleshoot Context Aware Access Bindings Or Logic

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A security engineer is configuring and troubleshooting context-aware access controls for administrative access to resources protected inside a VPC Service Controls perimeter.

The engineer has created Access Context Manager access levels that enforce device posture verification and IP origin restrictions. Different access bindings were applied to multiple Google Groups in Cloud Identity to govern various developer tiers. During security validation, the engineer discovers that a user assigned to both the Security-Core group (which enforces a strict managed device posture) and the General-Auditors group (which only requires a corporate network IP) can successfully invoke Google Cloud APIs on perimeter-protected resources from an unapproved personal device.

Why is this access permitted, and how should the security engineer remediate the issue?

VPC Service Controls ingress rules evaluate access levels using AND logic across group memberships; remediate by configuring an egress rule with an empty identity selector to drop unmanaged devices.

Multiple access bindings applicable to a user are evaluated using OR logic; remediate by making group memberships mutually exclusive or consolidating bindings into a single access binding with scoped access settings.

Access bindings apply exclusively to service accounts and ignore human users; remediate by binding the access level directly to user IAM roles through IAM Conditions.

Standard Cloud Identity access groups allow users to opt out dynamically; remediate by migrating user groups to enforcement groups and replacing access levels with Event Threat Detection rules.

Professional Cloud Security Engineer

Troubleshoot Context Aware Access Bindings Or Logic

Related questions