Professional Cloud Security Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
An enterprise integrates an external Identity Provider (IdP) with Google Cloud Identity for Single Sign-On (SSO) and enforces OS Login organization-wide for all Compute Engine instances. A security audit discovers that when departing employees are disabled in the external IdP, they can still establish SSH sessions to Linux VMs via OS Login.
How should the security team automate user lifecycle management to immediately revoke both Google Cloud console and OS Login SSH access upon employee departure?
Automated user lifecycle deprovisioning synchronizes account status between an authoritative external Identity Provider (or HR management system) and Google Cloud Identity using the Directory API (or automated SCIM/SAML connectors). By provisioning a dedicated automation identity granted delegated administrative privileges (Admin API privileges for Users and Groups), lifecycle events such as employee termination trigger immediate account suspension or deletion within Cloud Identity.
StudyCerts
StudyCertsUsers and Groups) allow programmatic user lifecycle management without assigning broad super-admin access across the entire organization.While disabling a user solely in an external IdP prevents new SSO web browser logins, it does not automatically modify or disable the existing Cloud Identity user object. Programmatically suspending the user in Cloud Identity via the Directory API guarantees that OS Login checks fail instantaneously upon offboarding.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.