An enterprise is configuring automated synchronization from Microsoft Entra ID to Cloud Identity to manage security groups and enforce least-privilege access policies across Google Cloud resources. The corporate security policy specifies the following requirements: The dedicated provisioning identity must operate with the minimum administrative privileges necessary in Cloud Identity and must not have full super-admin rights. End users must not be able to circumvent security policies or context-aware access bindings by unilaterally leaving provisioned groups. Which configuration should the administrator implement to meet these requirements?

Create a custom delegated administrator role with Admin API privileges enabled for Organization Units (Read), Users, and Groups for the provisioning user, and configure the groups as enforcement groups.: What this solution is This configuration establishes a delegated administrator role in the Google Admin Console with specific Admin API privileges and utilizes enforcement groups to secure membership and prevent policy circumvention. How it meets the requirements Principle of least privilege: Rather than granting the built-in super-admin role (which grants unrestricted control over the entire Google Cloud organization, IAM policies, and Cloud Identity domain), creating a custom delegated admin role limits the automated provisioning identity (azuread-provisioning) strictly to the required API permissions: Organization Units > Read, Users, and Groups. Preventing policy circumvention: By default, Cloud Identity access groups permit members to remove themselves from a group. When groups are used for access bindings and IAM-based policy enforcement, end users leaving a group can bypass mandatory controls. Setting them as enforcement groups restricts self-service group departure and guarantees policy enforcement. Key advantages and capabilities Granular API scoping: Confines the provisioning integration to managing non-admin user lifecycles, group creation, and group memberships without exposing organizational settings. Tamper-resistant access controls: Ensures synchronized groups maintain authoritative membership managed exclusively through the external identity provider. Reduced blast radius: Prevents compromised provisioning credentials from escalating privileges or altering organization-wide settings. Seamless lifecycle propagation: Synchronizes user additions, removals, and group memberships automatically to enforce consistent access across Google Cloud services. Why this is optimal Delegated administration provides the exact administrative boundary required for external directory synchronization, satisfying least privilege while enforcement groups ensure that context-aware access and IAM policies cannot be bypassed by end-user actions.

Automate Entra Id Cloud Identity Group Provisioning | Professional Cloud Security Engineer

AdvancedProfessional Cloud Security Engineer

An enterprise manages its Google Cloud Identity user accounts and directory groups programmatically using automated service accounts and identity provisioning pipelines. The security operations center (SOC) must implement continuous auditing, standardized log parsing, and real-time alerting within Google Security Operations (SecOps / Chronicle) to detect unauthorized or anomalous additions to privileged administrative groups. Which approach should the security engineer implement to properly standardize the audit logs and trigger real-time alerts on these programmatic identity modifications?

Administering user accounts and groups programmatically.

AdvancedProfessional Cloud Security Engineer

An enterprise integrates an external Identity Provider (IdP) with Google Cloud Identity for Single Sign-On (SSO) and enforces OS Login organization-wide for all Compute Engine instances. A security audit discovers that when departing employees are disabled in the external IdP, they can still establish SSH sessions to Linux VMs via OS Login. How should the security team automate user lifecycle management to immediately revoke both Google Cloud console and OS Login SSH access upon employee departure?

Administering user accounts and groups programmatically.

AdvancedProfessional Cloud Security Engineer

A financial services organization hosted on Google Cloud must comply with strict regulatory auditability and threat monitoring requirements across all existing and future projects in its resource hierarchy. The compliance and security teams mandate the following requirements: Capture all Admin Activity and full Data Access audit logs (DATA_READ, DATA_WRITE, and ADMIN_READ) across all services. Centrally aggregate all audit log entries across the entire resource hierarchy without missing newly created projects. Store audit logs in an immutable archive for seven years that prevents modification or premature deletion by any identity, including administrators. Detect threat behaviors in near real-time, such as anomalous IAM role grants and privilege escalation attempts. Which architecture should the security engineer implement to satisfy these compliance and monitoring requirements?

Mapping compliance requirements to Google Cloud services and security controls (e.g., network and access segmentation, audit log coverage).

AdvancedProfessional Cloud Security Engineer

An enterprise is deploying confidential workloads onto Compute Engine instances within a custom VPC subnet that has no external IP addresses and no default internet gateway route. The security team has defined a VPC Service Controls (VPC-SC) perimeter protecting services such as Cloud Storage and BigQuery. To enforce strict perimeter boundaries and prevent data exfiltration, the architecture must satisfy these criteria: Compute Engine instances must communicate privately with Google APIs using internal routing. Instances must be blocked from sending requests to Google APIs and services that are not supported by VPC Service Controls. Network routes and DNS resolution within the VPC must guarantee that all API traffic resolves exclusively to the restricted VIP range. Which network and DNS configuration should the security engineer implement?

Continually monitoring and restricting configured APIs.

AdvancedProfessional Cloud Security Engineer

A multinational financial services enterprise is preparing for an annual regulatory compliance audit. The security engineering team needs to determine every principal—including individual users, nested Google Groups, and service accounts—that possesses effective storage.objects.get or storage.objects.setIamPolicy permissions on specific sensitive Cloud Storage buckets across multiple production projects. Access to these buckets may be granted directly at the bucket level, inherited from parent folders or the organization root, or granted indirectly through custom IAM roles and group memberships. Which approach should the security engineering team use to evaluate these effective access paths with minimal operational overhead?

Applying Policy Intelligence.

IntermediateProfessional Cloud Architect

BigQuery Table Clones for Test Data Isolation

Testing frameworks (load/unit/integration)

Professional Cloud Security Engineer

Automate Entra Id Cloud Identity Group Provisioning

Related questions

BigQuery Table Clones for Test Data Isolation

Professional Cloud Security Engineer

Automate Entra Id Cloud Identity Group Provisioning

What this solution is

How it meets the requirements

Key advantages and capabilities

Why this is optimal

Related questions

BigQuery Table Clones for Test Data Isolation

What this solution is

How it meets the requirements

Key advantages and capabilities

Why this is optimal