Prepare and test your skills
Prepare and test your skills
Free sample question, answered and explained below. The Professional Cloud Security Engineer practice bank has 1,343 more like it. Try 10 free: instant score, no account.
An enterprise configured SAML 2.0 federation with a third-party Identity Provider (IdP) using Workforce Identity Federation to allow external corporate users to access Google Cloud resources. After rolling out an update to the IdP's claim schema, several users report that they cannot sign in, receiving authorization errors during the token exchange process.
The security team needs to inspect the incoming SAML assertion claims, identify any mismatched attribute mappings (such as google.subject and google.groups), and verify why the token exchange is failing.
Which troubleshooting approach should the security engineer take?
Event Threat Detection (ETD) is a built-in detection module within Security Command Center (SCC) Enterprise and Premium tiers that analyzes Cloud Logging streams (including Cloud Audit Logs and DNS logs) to identify active security threats, malware, brute force attempts, and anomalous administrative behavior.
google.subject attribute transformation logic.The requirement was to automatically detect malicious compromise attempts, suspicious administrator logins, or unauthorized modifications to organizational single sign-on settings.
The Google Cloud Directory Sync (GCDS) XML configuration file (commonly stored under ProgramData\gcds) contains directory server connection parameters, LDAP search rules, exclusion rules, and an encrypted OAuth 2.0 refresh token used by GCDS to synchronize directory objects into Cloud Identity via Google APIs.
The objective was to troubleshoot LDAP directory attribute queries, resolve scheduled user provisioning synchronization failures, or inspect local GCDS credential encryption.
Security Token Service (STS) is the underlying Google Cloud service responsible for validating external identity provider tokens (such as SAML 2.0 assertions or OIDC identity tokens) and exchanging them for short-lived Google Cloud federated access tokens during Workforce Identity Federation flows. Enabling Data Access audit logs for the Security Token Service API (sts.googleapis.com) allows administrators to capture and inspect the payload metadata, claim evaluation results, and attribute mapping operations in real time.
google.subject to the incoming email claim and google.groups to group assertions). If an IdP schema change introduces an attribute claim mismatch, STS logs the failure details directly in Cloud Audit Logs.google.subject), invalid assertion structures, or schema expression evaluation errors (such as failed lowerAscii() transformations).Using Data Access audit logs for the Security Token Service API directly pinpoints the exact point of failure within the federated token exchange pipeline without requiring client-side packet capture or invasive identity provider reconfigurations.
VPC Flow Logs record network flow samples for TCP, UDP, and ICMP traffic sent to and from virtual machine network interfaces (NICs) within Google Cloud Virtual Private Cloud (VPC) subnets.
sts.googleapis.com), completely bypassing private VM VPC subnet interfaces.The objective was to troubleshoot network egress filtering, determine if firewall rules were blocking outbound TCP port 443 connectivity to Google APIs from Compute Engine instances, or analyze network throughput.
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
Keep the momentum going with these hand-picked practice scenarios
Last updated Validated