Prepare and test your skills
Prepare and test your skills
Free sample question, answered and explained below. The Professional Cloud Security Engineer practice bank has 1,343 more like it. Try 10 free: instant score, no account.
An enterprise integrates an external Identity Provider (IdP) with Google Cloud Identity for Single Sign-On (SSO) and enforces OS Login organization-wide for all Compute Engine instances. A security audit discovers that when departing employees are disabled in the external IdP, they can still establish SSH sessions to Linux VMs via OS Login.
How should the security team automate user lifecycle management to immediately revoke both Google Cloud console and OS Login SSH access upon employee departure?
Automated user lifecycle deprovisioning synchronizes account status between an authoritative external Identity Provider (or HR management system) and Google Cloud Identity using the Directory API (or automated SCIM/SAML connectors). By provisioning a dedicated automation identity granted delegated administrative privileges (Admin API privileges for Users and Groups), lifecycle events such as employee termination trigger immediate account suspension or deletion within Cloud Identity.
Users and Groups) allow programmatic user lifecycle management without assigning broad super-admin access across the entire organization.While disabling a user solely in an external IdP prevents new SSO web browser logins, it does not automatically modify or disable the existing Cloud Identity user object. Programmatically suspending the user in Cloud Identity via the Directory API guarantees that OS Login checks fail instantaneously upon offboarding.
Metadata key scouring involves querying the Compute Engine API to locate and remove public SSH keys stored in project-wide (commonInstanceMetadata) or instance-specific metadata attributes.
enable-oslogin=TRUE), Compute Engine completely ignores legacy metadata-based SSH keys. OS Login stores and manages keys in the user's Cloud Identity POSIX profile rather than in instance metadata.compute.projects.setCommonInstanceMetadata, introducing unnecessary privileged attack surface.The organization were not using OS Login and instead relied entirely on legacy metadata-based public SSH keys for VM authentication.
roles/compute.osLoginExternalUser) to the external IdP service account at the organization level.The roles/compute.osLoginExternalUser IAM role allows external Google identities (such as consumer @gmail.com accounts or accounts from separate Google Cloud organizations) to interact with OS Login by creating POSIX profile information in a target organization.
roles/compute.osLogin or roles/compute.osAdminLogin to grant actual login privileges.The security team needed to allow external third-party contractors using consumer Google accounts to log into OS Login-enabled virtual machines.
SAML Single Logout (SLO) and session length controls terminate existing web browser cookies and prompt users to re-authenticate against the identity provider after a defined period of inactivity or token expiration.
ACTIVE state.The requirement were strictly limited to terminating interactive Google Cloud web console browser sessions when a user logs out of the corporate portal.
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
Keep the momentum going with these hand-picked practice scenarios
Last updated Validated