An enterprise organization is establishing baseline authentication security controls across its Cloud Identity and Google Cloud environment. The security engineering team needs to enforce hardened authentication and recovery policies for privileged accounts (super administrators) while maintaining standard policies for general workforce users. Specifically, the implementation must achieve the following requirements: Super administrator identities must be isolated to apply targeted authentication policies. Privileged accounts must be protected against phishing attacks by enforcing hardware-backed 2-Step Verification (2SV). Privileged accounts must prevent unauthorized access through self-service recovery bypasses. Which configuration strategy should the security engineer implement in the Google Admin console?

Create a dedicated Organizational Unit (OU) for super administrator accounts, enforce 2-Step Verification requiring Security Keys only on that OU, and disable automated non-admin account recovery.: What this solution is This solution establishes a structured identity governance model in Cloud Identity by isolating privileged super administrator accounts into a dedicated Organizational Unit (OU). By applying targeted policies to this OU, administrators can mandate hardware security keys (such as Titan Security Keys) for 2-Step Verification (2SV) and restrict insecure self-service account recovery channels. How it meets the requirements Privileged Account Isolation: Placing super administrators into a dedicated OU allows security teams to define granular, high-security policies that apply exclusively to privileged users without disrupting standard users across the organization. Phishing-Resistant 2-Step Verification: Mandating Security Keys only (FIDO2/WebAuthn hardware tokens) ensures that second-factor authentication cannot be intercepted by man-in-the-middle or credential phishing attacks, satisfying Google Control ID CI-CO-6.1 and CI-CO-6.2. Secure Account Recovery: Disabling automated user self-service password recovery for the administrator OU ensures that an attacker cannot bypass strong 2SV requirements by compromising recovery email addresses or mobile phone numbers. Key advantages and capabilities Granular Policy Inheritance: Cloud Identity applies organizational unit policies hierarchically, allowing distinct 2SV enforcement modes, grace periods, and credential restrictions across OUs. Cryptographic Protection: Hardware keys provide cryptographic proof of domain binding, neutralizing sophisticated phishing and reverse-proxy attacks. Defense-in-Depth for Admins: Protects the root of administrative trust across Google Cloud projects, Organization Policies, and resource hierarchies. Streamlined Auditing: Grouping all super admin principals into a single OU simplifies periodic access certification and compliance reporting. Why this is optimal Isolating privileged identities into an administrative OU is the Google Cloud standard architecture for enforcing elevated controls. Applying FIDO2/Titan Security Key enforcement exclusively to this OU guarantees maximum identity assurance for privileged accounts while preventing account takeovers via legacy recovery mechanisms.

StudyCerts

Professional Cloud Security Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Cloud Identity Super Admin 2sv Enforcement 2

Section: Creating a password and session management policy for user accounts.

An enterprise organization is establishing baseline authentication security controls across its Cloud Identity and Google Cloud environment. The security engineering team needs to enforce hardened authentication and recovery policies for privileged accounts (super administrators) while maintaining standard policies for general workforce users.

Specifically, the implementation must achieve the following requirements:

Super administrator identities must be isolated to apply targeted authentication policies.
Privileged accounts must be protected against phishing attacks by enforcing hardware-backed 2-Step Verification (2SV).
Privileged accounts must prevent unauthorized access through self-service recovery bypasses.

Which configuration strategy should the security engineer implement in the Google Admin console?

Configure Workload Identity Federation with SAML 2.0 assertion encryption for all super administrators and grant them the Service Account Token Creator role on host project service accounts.

Create a dedicated Organizational Unit (OU) for super administrator accounts, enforce 2-Step Verification requiring Security Keys only on that OU, and disable automated non-admin account recovery.

Use Policy Analyzer on the root organization node to enforce session expiration intervals, and configure automated OAuth client ID secret rotation every 24 hours.

Keep all administrator and standard users in the root Organizational Unit (OU), configure global 2-Step Verification using SMS or voice codes, and enable automated email password recovery.

Professional Cloud Security Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Cloud Identity Super Admin 2sv Enforcement 2

Section: Creating a password and session management policy for user accounts.

Specifically, the implementation must achieve the following requirements:

Super administrator identities must be isolated to apply targeted authentication policies.
Privileged accounts must be protected against phishing attacks by enforcing hardware-backed 2-Step Verification (2SV).
Privileged accounts must prevent unauthorized access through self-service recovery bypasses.

Which configuration strategy should the security engineer implement in the Google Admin console?

Configure Workload Identity Federation with SAML 2.0 assertion encryption for all super administrators and grant them the Service Account Token Creator role on host project service accounts.

Create a dedicated Organizational Unit (OU) for super administrator accounts, enforce 2-Step Verification requiring Security Keys only on that OU, and disable automated non-admin account recovery.

Use Policy Analyzer on the root organization node to enforce session expiration intervals, and configure automated OAuth client ID secret rotation every 24 hours.

Keep all administrator and standard users in the root Organizational Unit (OU), configure global 2-Step Verification using SMS or voice codes, and enable automated email password recovery.

Explanations

What this solution is

This solution establishes a structured identity governance model in Cloud Identity by isolating privileged super administrator accounts into a dedicated Organizational Unit (OU). By applying targeted policies to this OU, administrators can mandate hardware security keys (such as Titan Security Keys) for 2-Step Verification (2SV) and restrict insecure self-service account recovery channels.

How it meets the requirements

Privileged Account Isolation: Placing super administrators into a dedicated OU allows security teams to define granular, high-security policies that apply exclusively to privileged users without disrupting standard users across the organization.
Phishing-Resistant 2-Step Verification: Mandating Security Keys only (FIDO2/WebAuthn hardware tokens) ensures that second-factor authentication cannot be intercepted by man-in-the-middle or credential phishing attacks, satisfying Google Control ID CI-CO-6.1 and CI-CO-6.2.
Secure Account Recovery: Disabling automated user self-service password recovery for the administrator OU ensures that an attacker cannot bypass strong 2SV requirements by compromising recovery email addresses or mobile phone numbers.

Key advantages and capabilities

Granular Policy Inheritance: Cloud Identity applies organizational unit policies hierarchically, allowing distinct 2SV enforcement modes, grace periods, and credential restrictions across OUs.
Cryptographic Protection: Hardware keys provide cryptographic proof of domain binding, neutralizing sophisticated phishing and reverse-proxy attacks.
Defense-in-Depth for Admins: Protects the root of administrative trust across Google Cloud projects, Organization Policies, and resource hierarchies.
Streamlined Auditing: Grouping all super admin principals into a single OU simplifies periodic access certification and compliance reporting.

Why this is optimal

Isolating privileged identities into an administrative OU is the Google Cloud standard architecture for enforcing elevated controls. Applying FIDO2/Titan Security Key enforcement exclusively to this OU guarantees maximum identity assurance for privileged accounts while preventing account takeovers via legacy recovery mechanisms.

View source documentation

Professional Cloud Security Engineer

Cloud Identity Super Admin 2sv Enforcement 2

Professional Cloud Security Engineer

Cloud Identity Super Admin 2sv Enforcement 2

What this solution is

How it meets the requirements

Key advantages and capabilities

Why this is optimal

Related questions