Prepare and test your skills
Prepare and test your skills
Free sample question, answered and explained below. The Professional Cloud Security Engineer practice bank has 1,343 more like it. Try 10 free: instant score, no account.
An enterprise is integrating its corporate third-party Identity Provider (IdP) with Google Cloud using Cloud Identity as a Service Provider (SP). The security architect must satisfy the following technical requirements:
Which configuration strategy should the architect implement in Cloud Identity?
This configuration attempts to use Workforce Identity Federation to grant external identities direct access to Google Cloud resources without creating corresponding Cloud Identity user accounts.
principalSet://iam.googleapis.com/...).The organization wanted workforce users to access Google Cloud APIs and console resources directly using external credentials without provisioning managed Cloud Identity directory accounts.
This configuration sets up Workload Identity Federation and SPIFFE-attested agent identities for machine-to-machine, containerized, or AI agent workloads, while using VPC Service Controls for perimeter security.
principal://TRUST_DOMAIN/NAMESPACE/AGENT_NAME and are tied to x509 workload certificates.The goal was to authenticate non-human automated agents or external cloud workloads securely into Google Cloud without managing long-lived service account keys.
This configuration establishes a federated SAML 2.0 authentication trust between an external Identity Provider (IdP) and Cloud Identity acting as the Service Provider (SP), while using granular Organizational Unit (OU) policy assignments and session controls to enforce least privilege, resilience, and automated onboarding.
NameID and core user attributes) and dynamically instantiate new user accounts upon first successful logon without pre-synchronizing via GCDS.accounts.google.com/a/), super administrators can authenticate natively using local credentials if the third-party IdP suffers downtime.This architecture directly addresses identity lifecycle, security enforcement, and high availability by using native Cloud Identity features without introducing unnecessary external proxies or unmanaged credential silos.
This configuration applies domain-wide SAML SSO across all users indiscriminately, attempts to use webhooks with Google Cloud Directory Sync (GCDS), and tries to modify OAuth token lifetimes at the IAM resource level.
The organization required strict batch-synchronized LDAP attribute parity using on-premises infrastructure and enforced universal IdP redirection with no local fallback.
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
Keep the momentum going with these hand-picked practice scenarios
Last updated