A multinational enterprise is updating its security posture in Cloud Identity and Google Cloud to protect privileged administrative access. The security architecture team must establish stringent policies for Super Administrator accounts to prevent credential theft, phishing, and unauthorized privilege escalation. The policy must enforce the following security requirements: Super Administrator accounts must be protected with phishing-resistant multi-factor authentication. Administrators must not use Super Administrator privileges for day-to-day administrative operations. Persistent trusted sessions that bypass multi-factor authentication challenges must be prohibited. All privileged administrative actions must be fully traceable to individual identities. Which set of controls should the organization implement?

Place Super Administrator accounts in a dedicated Organizational Unit (OU) enforcing 2-Step Verification with Security Keys only, disable the 'Allow user to trust the device' setting, assign pre-built or custom administrative roles to separate daily accounts, and enable administrative audit logging.: What the Recommended Architecture Is This solution establishes a defense-in-depth security model for Cloud Identity Super Administrator accounts by isolating high-privilege identities into a dedicated Organizational Unit (OU). Within this OU, strict identity verification policies, session constraints, and role-delegation rules are uniformly applied. How It Meets the Security Requirements Phishing-Resistant MFA: Restricting the 2-Step Verification (2SV) method exclusively to physical Security Keys (FIDO2/WebAuthn) neutralizes phishing, credential replay, and man-in-the-middle (MitM) attacks. Least Privilege and Role Delegation: Daily operations are conducted using standard accounts provisioned with pre-built administrative roles or granular custom administrator roles, eliminating the need for daily Super Admin usage. Session Integrity: Disabling the 'Allow user to trust the device' setting prevents long-lived cookies from bypassing step-up verification prompts across administrative sessions. Accountability & Traceability: Each administrator receives a named, dedicated account rather than sharing credentials, ensuring all operations recorded in Cloud Audit Logs and Admin Console Audit Logs provide non-repudiation. Key Advantages Phishing Immunity: FIDO-compliant hardware keys cryptographically bind authentication to the specific origin URL, thwarting reverse-proxy phishing attacks. Reduced Blast Radius: Segregating daily tasks prevents accidental destructive changes or widespread compromise from compromised developer workstations. Comprehensive Audit Visibility: Facilitates real-time anomaly detection and SIEM ingestion of administrative activities. Granular Policy Application: Utilizing a dedicated OU allows applying strict authentication and session duration rules without impacting regular business users. Why This Is Optimal Isolating Super Admin accounts into their own organizational unit with mandatory hardware security keys and delegated least-privilege roles directly enforces Google Cloud security best practices, eliminating shared account vulnerabilities and credential persistence risks.

StudyCerts

Professional Cloud Security Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Super Admin Account Security Controls

Section: Managing a super administrator account.

A multinational enterprise is updating its security posture in Cloud Identity and Google Cloud to protect privileged administrative access. The security architecture team must establish stringent policies for Super Administrator accounts to prevent credential theft, phishing, and unauthorized privilege escalation.

The policy must enforce the following security requirements:

Super Administrator accounts must be protected with phishing-resistant multi-factor authentication.
Administrators must not use Super Administrator privileges for day-to-day administrative operations.
Persistent trusted sessions that bypass multi-factor authentication challenges must be prohibited.
All privileged administrative actions must be fully traceable to individual identities.

Which set of controls should the organization implement?

Deploy a single shared break-glass Super Administrator account with a rotating static password, disable multi-factor authentication to avoid device lockouts, and restrict access exclusively using IP-based VPC Service Controls.

Assign Super Administrator privileges directly to primary corporate email accounts, enable Google Prompt on personal mobile devices, and extend session lengths to 30 days with device trusting enabled to prevent frequent re-authentication.

Place Super Administrator accounts in a dedicated Organizational Unit (OU) enforcing 2-Step Verification with Security Keys only, disable the 'Allow user to trust the device' setting, assign pre-built or custom administrative roles to separate daily accounts, and enable administrative audit logging.

Configure Single Sign-On (SSO) with a third-party Identity Provider for Super Administrator accounts, allow SMS-based verification as a backup method, and grant all senior engineers the Super Administrator role to ensure continuous operational coverage.

Professional Cloud Security Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Super Admin Account Security Controls

Section: Managing a super administrator account.

The policy must enforce the following security requirements:

Super Administrator accounts must be protected with phishing-resistant multi-factor authentication.
Administrators must not use Super Administrator privileges for day-to-day administrative operations.
Persistent trusted sessions that bypass multi-factor authentication challenges must be prohibited.
All privileged administrative actions must be fully traceable to individual identities.

Which set of controls should the organization implement?

Explanations

What the Recommended Architecture Is

This solution establishes a defense-in-depth security model for Cloud Identity Super Administrator accounts by isolating high-privilege identities into a dedicated Organizational Unit (OU). Within this OU, strict identity verification policies, session constraints, and role-delegation rules are uniformly applied.

How It Meets the Security Requirements

Phishing-Resistant MFA: Restricting the 2-Step Verification (2SV) method exclusively to physical Security Keys (FIDO2/WebAuthn) neutralizes phishing, credential replay, and man-in-the-middle (MitM) attacks.
Least Privilege and Role Delegation: Daily operations are conducted using standard accounts provisioned with pre-built administrative roles or granular custom administrator roles, eliminating the need for daily Super Admin usage.
Session Integrity: Disabling the 'Allow user to trust the device' setting prevents long-lived cookies from bypassing step-up verification prompts across administrative sessions.
Accountability & Traceability: Each administrator receives a named, dedicated account rather than sharing credentials, ensuring all operations recorded in Cloud Audit Logs and Admin Console Audit Logs provide non-repudiation.

Key Advantages

Phishing Immunity: FIDO-compliant hardware keys cryptographically bind authentication to the specific origin URL, thwarting reverse-proxy phishing attacks.
Reduced Blast Radius: Segregating daily tasks prevents accidental destructive changes or widespread compromise from compromised developer workstations.
Comprehensive Audit Visibility: Facilitates real-time anomaly detection and SIEM ingestion of administrative activities.
Granular Policy Application: Utilizing a dedicated OU allows applying strict authentication and session duration rules without impacting regular business users.

Why This Is Optimal

Isolating Super Admin accounts into their own organizational unit with mandatory hardware security keys and delegated least-privilege roles directly enforces Google Cloud security best practices, eliminating shared account vulnerabilities and credential persistence risks.

View source documentation

Professional Cloud Security Engineer

Super Admin Account Security Controls

Professional Cloud Security Engineer

Super Admin Account Security Controls

What the Recommended Architecture Is

How It Meets the Security Requirements

Key Advantages

Why This Is Optimal

Related questions