Prepare and test your skills
Prepare and test your skills
Free sample question, answered and explained below. The Professional Cloud Security Engineer practice bank has 1,343 more like it. Try 10 free: instant score, no account.
An enterprise uses Microsoft Entra ID as its authoritative identity provider (IdP) and federates authentication to Google Cloud using SAML Single Sign-On (SSO). The organization is designing an automated user lifecycle management architecture to synchronize employee provisioning, security group assignments for IAM access, and deprovisioning workflows upon employee departure.
The security team establishes the following design requirements:
Which solution should the enterprise implement?
This approach relies on enforcing the enable-oslogin organization policy across Google Cloud projects while manually or directly granting roles/compute.osAdminLogin to individual users and writing keys to VM instance metadata.
The scenario focused exclusively on preventing users from disabling OS Login via metadata overrides rather than designing an automated identity lifecycle workflow.
This approach assigns the super-admin administrative role to the Entra ID provisioning account in Cloud Identity and relies on SAML Single Sign-On session lifetimes to handle the deprovisioning of departed employees.
The organization required the provisioning connector to manage existing delegated administrators or other super-admins, and workloads did not utilize OS Login for SSH session authentication.
Automated user lifecycle management between an external Identity Provider (Microsoft Entra ID) and Google Cloud Identity relies on System for Cross-domain Identity Management (SCIM) protocols. This architecture uses a dedicated provisioning service account in Cloud Identity to synchronize user identities, group memberships, and lifecycle status changes from the authoritative identity source into Google Cloud.
Users, Groups, and Organization Units > Read—allows the provisioning user (azuread-provisioning) to manage standard users and security groups without granting unrestricted super-admin privileges across the Google Cloud organization.This architecture establishes a secure, least-privilege administrative bridge while guaranteeing that deprovisioning signals in the authoritative directory immediately invalidate all access pathways into Google Cloud.
This configuration attempts to use Google Cloud resource-level IAM roles (roles/iam.securityAdmin) for the identity connector and uses Privileged Access Manager (PAM) to locate and deactivate dormant employee accounts.
roles/iam.securityAdmin manages Google Cloud IAM policies at the organization, folder, or project level, but it cannot create, modify, or suspend directory objects (users and groups) in the Cloud Identity / Google Workspace Admin Console.The primary objective was managing time-bound, just-in-time IAM role elevations for privileged operators with automated ticket-based approvals.
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
Keep the momentum going with these hand-picked practice scenarios
Last updated Validated