A financial services organization federates its workforce identity architecture with Cloud Identity and manages access across multiple Google Cloud projects using group-based IAM bindings. The security team must implement a group lifecycle and access governance strategy that satisfies the following requirements: Automated Membership Lifecycle: Automatically provision and deprovision users from Google Groups as employee job roles and department attributes change. Synchronization Integrity: Prevent group managers and standard users from manually adding or removing members in the console, ensuring the group remains strictly synchronized with organizational rules. Access Review and Rightsizing: Periodically analyze, review, and rightsize IAM role grants at an enterprise scale to identify and remove unused permissions. Which combination of Google Cloud identity and governance capabilities should the organization implement?

Configure Dynamic groups based on employee attribute queries, lock the groups to prevent manual membership tampering, and configure BigQuery Data Transfer Service to export IAM recommendations to BigQuery for automated access reviews.: What the Solution Is Dynamic groups in Cloud Identity, combined with locked group security controls and IAM Recommender export to BigQuery, provide an automated, tamper-resistant group lifecycle and access review architecture. How It Meets the Requirements Automated Membership Lifecycle: Dynamic groups automatically manage user inclusion and removal by continuously evaluating membership queries against employee attributes (such as jobTitle, department, or location) synced from the primary identity system. Synchronization Integrity: Enabling locked group settings restricts group attribute and membership modifications strictly to authorized administrators (such as Groups Admin), preventing local group owners, managers, or members from manually altering memberships and causing configuration drift from the source of truth. Access Review and Rightsizing: Configuring the BigQuery Data Transfer Service to export IAM Recommender insights and REMOVE_ROLE recommendations allows security teams to query, aggregate, and review unused privileges and access across all folders and projects at an enterprise scale. Key Advantages and Capabilities Zero-Touch Deprovisioning: Automatically revokes access to cloud resources the moment an employee changes department or leaves their role. Centralized Governance: Eliminates synchronization drift caused by manual intervention in Google Groups. Enterprise Scale Analysis: Uses BigQuery SQL queries and visualization tools (like Looker Studio) to systematically track and remediate stale IAM bindings. Least Privilege Enforcement: Continuously aligns granted permissions with actual usage patterns detected by machine learning models. Why This Is Optimal This architecture completely eliminates manual provisioning overhead, enforces strict group integrity, and automates periodic access reviews using native Google Cloud Policy Intelligence and Cloud Identity capabilities.

Group Lifecycle Dynamic Locked Recommender | Professional Cloud Security Engineer

StudyCerts

Explanations

What the Solution Is

Dynamic groups in Cloud Identity, combined with locked group security controls and IAM Recommender export to BigQuery, provide an automated, tamper-resistant group lifecycle and access review architecture.

How It Meets the Requirements

Automated Membership Lifecycle: Dynamic groups automatically manage user inclusion and removal by continuously evaluating membership queries against employee attributes (such as jobTitle, department, or location) synced from the primary identity system.
Synchronization Integrity: Enabling locked group settings restricts group attribute and membership modifications strictly to authorized administrators (such as Groups Admin), preventing local group owners, managers, or members from manually altering memberships and causing configuration drift from the source of truth.
Access Review and Rightsizing: Configuring the BigQuery Data Transfer Service to export IAM Recommender insights and REMOVE_ROLE recommendations allows security teams to query, aggregate, and review unused privileges and access across all folders and projects at an enterprise scale.

Key Advantages and Capabilities

Zero-Touch Deprovisioning: Automatically revokes access to cloud resources the moment an employee changes department or leaves their role.
Centralized Governance: Eliminates synchronization drift caused by manual intervention in Google Groups.
Enterprise Scale Analysis: Uses BigQuery SQL queries and visualization tools (like Looker Studio) to systematically track and remediate stale IAM bindings.
Least Privilege Enforcement: Continuously aligns granted permissions with actual usage patterns detected by machine learning models.

Why This Is Optimal

This architecture completely eliminates manual provisioning overhead, enforces strict group integrity, and automates periodic access reviews using native Google Cloud Policy Intelligence and Cloud Identity capabilities.

View source documentation

Professional Cloud Security Engineer

Group Lifecycle Dynamic Locked Recommender