Prepare and test your skills
Prepare and test your skills
Free sample question, answered and explained below. The Professional Cloud Security Engineer practice bank has 1,343 more like it. Try 10 free: instant score, no account.
A multinational enterprise is designing a just-in-time (JIT) privileged access architecture in Google Cloud for their production storage environment. The security team has defined the following operational and compliance requirements:
sre-team@example.com group) and an automated deployment pipeline identity (deploy-runner@proj.iam.gserviceaccount.com) must be able to temporarily elevate to roles/storage.admin.itsm-validator@proj.iam.gserviceaccount.com) to eliminate manual bottlenecks.Which Privileged Access Manager (PAM) entitlement configuration meets these requirements?
roles/storage.admin with a maximum duration of 4 hours, require justification, and configure the ITSM service account as an approver without granting requesters or approvers roles/privilegedaccessmanager.admin.Privileged Access Manager (PAM) is a Google Cloud security service designed to manage, automate, and audit just-in-time (JIT) privilege elevation. PAM uses entitlements as policy definitions that establish which principals can request elevated roles, what roles can be obtained, the maximum grant lifespan, mandatory justifications, and approval workflows.
sre-team@example.com) and non-human identities (service accounts like deploy-runner@proj.iam.gserviceaccount.com). Service accounts can self-elevate for automated deployment tasks rather than holding permanent high-privilege bindings.gcloud pam grants approve or REST endpoint) using the itsm-validator service account credentials, removing manual operator delays.APPROVAL_AWAITED or ACTIVE state.roles/privilegedaccessmanager.admin). They only interact with their assigned requester and approver bindings.This architecture directly satisfies all least-privilege, multi-identity, automation, and governance requirements using native Google Cloud PAM functionality without custom infrastructure or unnecessary privilege delegation.
roles/storage.admin and assign roles/privilegedaccessmanager.admin and roles/iam.securityAdmin to all SREs and the ITSM service account so they have API permissions to request and approve grants.This option suggests granting high-privilege administrative roles—specifically Privileged Access Manager Admin (roles/privilegedaccessmanager.admin) and Security Admin (roles/iam.securityAdmin)—to the requesting engineers and the automated approver identity to allow them to create and approve grant requests.
roles/privilegedaccessmanager.admin allows principals to create, modify, and delete PAM entitlements across the entire resource hierarchy. Granting roles/iam.securityAdmin grants broad authority to edit project-wide IAM policies.The engineers were platform security administrators responsible for onboarding PAM, granting permissions to the PAM Service Agent, and authoring new entitlement resources across the organization hierarchy.
roles/storage.admin IAM bindings with time-based IAM Conditions to the SRE group and deployment service account, and use a Cloud Function to update the condition timestamp upon ITSM ticket generation.This approach relies on static IAM Conditions with date/time expressions attached to permanent IAM policy bindings on the project, combined with custom orchestration (Cloud Functions) to update condition timestamps based on ITSM triggers.
read-modify-write race conditions) on the resource's IAM policy.request.time or resource tags dynamically at evaluation time.The organization needed to enforce recurring access windows (such as restricting database read access strictly between 09:00 and 17:00 UTC) without requiring an interactive request, justification, or approval process.
roles/storage.admin, configure the ITSM service account to add members via the Cloud Identity API upon request, and run a scheduled cron job to remove members after 4 hours.This option attempts to implement temporary access by granting the target IAM role to a Google Group and orchestrating temporary membership using external scripts that add and delete users via the Google Workspace or Cloud Identity Directory API.
APPROVAL_AWAITED, ACTIVE, EXPIRED, REVOKED) and built-in approval delegation.The organization lacked access to Privileged Access Manager and needed a rudimentary, coarse-grained temporary access mechanism for human users using legacy directory tooling.
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
Keep the momentum going with these hand-picked practice scenarios
Last updated Validated