Prepare and test your skills
Prepare and test your skills
Free sample question, answered and explained below. The Professional Cloud Security Engineer practice bank has 1,343 more like it. Try 10 free: instant score, no account.
An organization is designing an automated identity synchronization architecture between their on-premises Active Directory Domain Services (AD DS) forest and Cloud Identity to enable workforce access to Google Cloud resources. The security team establishes the following requirements:
Which architectural and configuration approach should the organization implement?
Google Cloud Directory Sync (GCDS) is an on-premises synchronization tool that connects to an LDAP directory (such as Active Directory) to provision and synchronize users, groups, and organizational units into Cloud Identity or Google Workspace. GCDS performs one-way synchronization of identity metadata via the Google Directory API without reading or synchronizing user passwords.
This architecture combines automated metadata synchronization via GCDS with delegated authentication via SAML SSO, perfectly satisfying corporate data governance, zero password leakage, and disaster recovery requirements.
G Suite Password Sync (GSPS) is an on-premises tool installed on Active Directory domain controllers that intercepts password change events and transmits encrypted password hashes to Cloud Identity so users can authenticate directly against Google's authentication servers.
The organization wanted seamless direct authentication against Google Cloud without deploying SAML federation infrastructure like AD FS, and explicitly permitted password hash synchronization.
Managed Service for Microsoft Active Directory is a Google-managed Google Cloud service running actual Microsoft AD Domain Controllers. The Active Directory Migration Tool (ADMT) is used to migrate AD objects, Security Identifiers (SIDs), and password hashes across AD domains and forests.
The goal was to migrate on-premises Windows server workloads and enterprise Active Directory services directly into Google Cloud Compute Engine while preserving user SID history.
Enabling SAML Single Sign-On at the root organizational unit forces all users within the Cloud Identity domain to authenticate through the configured third-party Identity Provider (such as Active Directory Federation Services or Microsoft Entra ID).
The organization had a strict compliance rule requiring 100% of all user and administrative sign-ins to be captured exclusively in on-premises AD FS security event logs without exception for break-glass or automation accounts.
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
Keep the momentum going with these hand-picked practice scenarios
Last updated Validated