An enterprise organization is hardening its Google Cloud and Cloud Identity access governance model. A security audit reveals that several administrators hold permanent Super Admin privileges for day-to-day administrative tasks, creating critical risks of configuration tampering, accidental service disruption, and broad privilege abuse. The security team must implement a robust access control architecture meeting these requirements: Eliminate standing super administrator assignments by enforcing least privilege and separation of duties for daily operations. Provide an audited break-glass emergency procedure for critical Cloud Identity recovery scenarios with controls to prevent unilateral unauthorized activation. Provide time-bound, just-in-time (JIT) privilege elevation with mandatory business justifications and audit logging for sensitive infrastructure administration. Which set of controls should the organization implement?

Assign granular pre-built or custom administrative roles for daily administrative tasks; configure Privileged Access Manager (PAM) entitlements with time-bound grants and mandatory justification for infrastructure privilege elevation; maintain dedicated, non-federated break-glass super admin accounts protected by split operations and monitored via automated security alerts.: What the Recommended Architecture Is This architecture combines least-privilege role segregation, just-in-time (JIT) privileged access management, and governed break-glass procedures to eliminate standing super administrator accounts while preserving operational continuity. How It Meets the Requirements Eliminating standing privileges through separation of duties: Replacing standing super administrator assignments with pre-built administrative roles (such as User Management Admin or Help Desk Admin) and custom IAM roles ensures staff only have the specific permissions required for daily tasks. Governed break-glass access: Establishing dedicated, separate break-glass emergency accounts (e.g., admin-breakglass@example.com) ensures emergency recovery if identity federation fails. Enforcing split operations (where one individual holds the credentials and another holds the hardware MFA token or approval authority) prevents unilateral account abuse. Time-bound elevation and auditing: Using Privileged Access Manager (PAM) enables users to request temporary, time-bound grants against entitlements that require explicit business justifications, automated approvals, and detailed audit logging in Cloud Logging and Security Command Center. Key Advantages and Capabilities Attack Surface Minimization: Prevents continuous privilege exposure and limits the blast radius of compromised credentials. Multi-Party Governance: Prevents insider threats or single compromised identities from executing unilateral enterprise-wide modifications. Automated Lifecycle Controls: Automatically revokes elevated access after the configured duration expires, eliminating orphaned permissions. Comprehensive Traceability: Captures end-to-end audit logs of who requested access, the justification provided, who approved it, and what actions were performed. Why This Is Optimal This solution directly implements cloud security best practices by decoupling everyday administrative responsibilities from super admin access, establishing dual-control emergency recovery paths, and enforcing temporary elevation via Privileged Access Manager.

StudyCerts

Professional Cloud Security Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Mitigate Super Admin Privileged Access Risks

Section: Managing a super administrator account.

An enterprise organization is hardening its Google Cloud and Cloud Identity access governance model. A security audit reveals that several administrators hold permanent Super Admin privileges for day-to-day administrative tasks, creating critical risks of configuration tampering, accidental service disruption, and broad privilege abuse.

The security team must implement a robust access control architecture meeting these requirements:

Eliminate standing super administrator assignments by enforcing least privilege and separation of duties for daily operations.
Provide an audited break-glass emergency procedure for critical Cloud Identity recovery scenarios with controls to prevent unilateral unauthorized activation.
Provide time-bound, just-in-time (JIT) privilege elevation with mandatory business justifications and audit logging for sensitive infrastructure administration.

Which set of controls should the organization implement?

Configure domain-wide delegation for all administrator accounts to impersonate the super administrator identity; use Cloud Functions to automatically disable the accounts after 8 hours; enable basic audit logging on the organization root node.

Disable service account key creation across the organization; enforce OS Login with two-step verification for all Compute Engine instances; configure Chrome Enterprise Premium certificate-based access for the super admin accounts.

Enforce Single Sign-On (SSO) with an external IdP for all super admin accounts; configure IAM session length policies to 1 hour; grant permanent Organization Administrator roles to the primary administrative user accounts.

Assign granular pre-built or custom administrative roles for daily administrative tasks; configure Privileged Access Manager (PAM) entitlements with time-bound grants and mandatory justification for infrastructure privilege elevation; maintain dedicated, non-federated break-glass super admin accounts protected by split operations and monitored via automated security alerts.

Professional Cloud Security Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Mitigate Super Admin Privileged Access Risks

Section: Managing a super administrator account.

The security team must implement a robust access control architecture meeting these requirements:

Eliminate standing super administrator assignments by enforcing least privilege and separation of duties for daily operations.
Provide an audited break-glass emergency procedure for critical Cloud Identity recovery scenarios with controls to prevent unilateral unauthorized activation.
Provide time-bound, just-in-time (JIT) privilege elevation with mandatory business justifications and audit logging for sensitive infrastructure administration.

Which set of controls should the organization implement?

Explanations

What the Recommended Architecture Is

This architecture combines least-privilege role segregation, just-in-time (JIT) privileged access management, and governed break-glass procedures to eliminate standing super administrator accounts while preserving operational continuity.

How It Meets the Requirements

Eliminating standing privileges through separation of duties: Replacing standing super administrator assignments with pre-built administrative roles (such as User Management Admin or Help Desk Admin) and custom IAM roles ensures staff only have the specific permissions required for daily tasks.
Governed break-glass access: Establishing dedicated, separate break-glass emergency accounts (e.g., admin-breakglass@example.com) ensures emergency recovery if identity federation fails. Enforcing split operations (where one individual holds the credentials and another holds the hardware MFA token or approval authority) prevents unilateral account abuse.
Time-bound elevation and auditing: Using Privileged Access Manager (PAM) enables users to request temporary, time-bound grants against entitlements that require explicit business justifications, automated approvals, and detailed audit logging in Cloud Logging and Security Command Center.

Key Advantages and Capabilities

Attack Surface Minimization: Prevents continuous privilege exposure and limits the blast radius of compromised credentials.
Multi-Party Governance: Prevents insider threats or single compromised identities from executing unilateral enterprise-wide modifications.
Automated Lifecycle Controls: Automatically revokes elevated access after the configured duration expires, eliminating orphaned permissions.
Comprehensive Traceability: Captures end-to-end audit logs of who requested access, the justification provided, who approved it, and what actions were performed.

Why This Is Optimal

This solution directly implements cloud security best practices by decoupling everyday administrative responsibilities from super admin access, establishing dual-control emergency recovery paths, and enforcing temporary elevation via Privileged Access Manager.

View source documentation

Professional Cloud Security Engineer

Mitigate Super Admin Privileged Access Risks

Professional Cloud Security Engineer

Mitigate Super Admin Privileged Access Risks

What the Recommended Architecture Is

How It Meets the Requirements

Key Advantages and Capabilities

Why This Is Optimal

Related questions