A security operations center (SOC) detects that an attacker compromised a developer's workstation and exfiltrated active gcloud CLI OAuth tokens to an external host to execute unauthorized Google Cloud API requests. The organization uses Cloud Identity federated with an external Identity Provider (IdP) using SAML 2.0 for Single Sign-On (SSO). The security team needs to achieve the following: Immediately terminate the attacker's ability to use the stolen gcloud CLI access and refresh tokens. Enforce time-bound session controls across both the Google Cloud console and the gcloud CLI. Prevent silent re-authentication at the end of each session period so that users must re-enter credentials and complete multi-factor authentication (MFA). Which set of actions should the security team take?

Remove the gcloud CLI (Google Cloud SDK) from the user's connected applications, configure Google Cloud session control to require re-authentication (1–24 hours), and set the external IdP session duration to be shorter than the Google Cloud session length.: What the solution is This remediation and hardening strategy combines OAuth token revocation via connected application management with Google Cloud session control and Identity Provider (IdP) session alignment to eliminate compromised credentials and enforce periodic re-authentication. How it meets the requirements Immediate Token Invalidation: Revoking the Google Cloud SDK from the user's list of connected applications immediately invalidates active OAuth 2.0 access tokens and long-lived refresh tokens across Google's authorization servers, preventing the attacker from continuing to make requests from external hosts. Unified Session Limits: Configuring the dedicated Google Cloud session control setting in Cloud Identity / Google Workspace establishes a strict re-authentication period (between 1 and 24 hours) that governs both the Google Cloud console and command-line interfaces such as the gcloud CLI. Preventing Silent Re-authentication: When an external SAML IdP session outlasts Google's session timeout, users are seamlessly re-authenticated upon redirection without entering credentials. Setting the external IdP session length shorter than the Google Cloud session length ensures that once the Google Cloud session expires, the IdP forces full credential re-entry and secondary MFA challenges. Key advantages and capabilities Targeted OAuth Revocation: Invalidates API bearer tokens without requiring account deletion or disrupting non-CLI directory assets. Dual-Interface Enforcement: Enforces session timeouts equally on browser sessions and SDK programmatic tokens. True Zero Trust Re-authentication: Mitigates credential reuse by blocking automatic SAML assertion refreshes at the identity layer. Auditable Lifecycle Management: Token revocations and session expirations produce structured audit logs in Cloud Audit Logs and the Admin Console. Why this is optimal Alternative measures—such as resetting account passwords or web sign-in cookies—do not invalidate existing OAuth access tokens that an attacker has already copied. Aligning IdP session lengths with Google Cloud re-authentication policies guarantees that session terminations enforce actual user challenges rather than silent automated renewals.

Manage Gcloud Oauth Tokens Session Control | Professional Cloud Security Engineer

AdvancedProfessional Cloud Security Engineer

An enterprise organization is establishing baseline authentication security controls across its Cloud Identity and Google Cloud environment. The security engineering team needs to enforce hardened authentication and recovery policies for privileged accounts (super administrators) while maintaining standard policies for general workforce users. Specifically, the implementation must achieve the following requirements: Super administrator identities must be isolated to apply targeted authentication policies. Privileged accounts must be protected against phishing attacks by enforcing hardware-backed 2-Step Verification (2SV). Privileged accounts must prevent unauthorized access through self-service recovery bypasses. Which configuration strategy should the security engineer implement in the Google Admin console?

Creating a password and session management policy for user accounts.

AdvancedProfessional Cloud Security Engineer

An enterprise organization federates user authentication with an external third-party SAML 2.0 Identity Provider (IdP) to access Google Cloud console and web applications. The security team must implement Context-Aware Access (CAA) and session governance to satisfy the following requirements: Restrict access strictly to corporate-managed devices that satisfy compliance posture, specific corporate IP subnets, and approved geographic regions. Enforce periodic IdP session re-authentication and strict web session lifetimes. Ensure users cannot circumvent security policies through group modifications or unintended policy inheritance. Which configuration strategy should the cloud security engineer implement to achieve these requirements?

Creating a password and session management policy for user accounts.

AdvancedProfessional Cloud Security Engineer

An enterprise maintains a hybrid architecture connecting an on-premises data center to a Google Cloud Virtual Private Cloud (VPC) over Cloud Interconnect. The organization has established the following security and networking requirements for name resolution: On-premises clients must resolve internal Google Cloud private DNS zones and Private Service Connect endpoints. Google Cloud Compute Engine instances must resolve corporate domains hosted on on-premises domain controllers without manually modifying client resolver configurations. The security operations center (SOC) must monitor and audit all name resolution requests to detect domain generation algorithm (DGA) query patterns and potential DNS data exfiltration attempts. Which Cloud DNS design and policy configuration should the security engineer implement to satisfy these requirements?

Configuring Cloud DNS security settings.

AdvancedProfessional Cloud Security Engineer

An enterprise is refactoring its security architecture on Google Cloud to adhere to the principle of least privilege and strict separation of duties. Currently, developers run automated deployment pipelines and scheduled tasks using their personal corporate user accounts, which requires assigning them broad, standing permissions. Furthermore, developers have generated and downloaded service account JSON keys to authenticate external CI/CD runners, and they occasionally impersonate service accounts directly in production to resolve urgent incidents. The security engineering team has established the following mandatory requirements: Decouple application execution and automated workflows from human identities. Eliminate the risks associated with static, long-lived service account key files. Prevent human identities from undermining context-aware access controls through service account impersonation. Provide human operators with just-in-time (JIT), time-bound privilege elevation for emergency tasks without granting standing administrative access. Which strategy should the security engineer implement to satisfy these requirements?

Identifying scenarios requiring service accounts.

AdvancedProfessional Cloud Security Engineer

An enterprise is deploying an AI agent runtime on Google Cloud that must securely query third-party external tool APIs across the internet. The agent workloads are hosted in a private VPC subnet without external IP addresses. To control and monitor outbound connections, all agent traffic to external APIs is routed through an Internal Application Load Balancer with internet Network Endpoint Groups (internet NEGs). The external API providers require all incoming API requests to originate from a known, dedicated set of allowlisted public IP addresses. Which network architecture configuration should the security engineer implement to satisfy these requirements?

Implementing security controls for Gemini Enterprise Agent Platform.

IntermediateProfessional Cloud Architect

Cloud Spanner Active-Active Multi-Region

Business use cases and product strategy

Professional Cloud Security Engineer

Manage Gcloud Oauth Tokens Session Control

Related questions

Cloud Spanner Active-Active Multi-Region

Professional Cloud Security Engineer

Manage Gcloud Oauth Tokens Session Control

What the solution is

How it meets the requirements

Key advantages and capabilities

Why this is optimal

Related questions

Cloud Spanner Active-Active Multi-Region

What the solution is

How it meets the requirements

Key advantages and capabilities

Why this is optimal