1.4 Managing and Implementing Authorization Controls PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which IAM role is considered privileged because it grants full access to all resources in a project and can set up billing?

   • Aroles/browser
   • Broles/viewer
   • Croles/owner
   • Droles/editor
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   Your company has a single project with a production application. The security policy requires that no single individual can both create service account keys and use those keys to access production resources. You need to design an IAM structure that enforces this separation of duties. What should you do?

   • AGrant the Service Account Admin role to all developers and the Service Account User role to the operations team.
   • BCreate a custom role with only the iam.serviceAccountKeys.create permission and grant it to the operations team.
   • CCreate two groups: one with the Service Account Key Admin role and another with the Service Account User role, and ensure no user is in both groups.
   • DGrant the Owner role to the security team and the Editor role to the development team.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   Your company uses BeyondCorp Enterprise to enforce context-aware access. You need to ensure that only users accessing from corporate-managed devices can reach a specific application. You have already created an access level that requires the device to be corporate-managed. What else must you configure to enforce this access level on the application?

   • AAssign the access level to the user's Google account in the Admin console.
   • BCreate an IAM policy binding that grants access to the application and attach the access level as an IAM condition.
   • CConfigure the access level directly on the application's load balancer.
   • DCreate a VPC Service Controls perimeter that includes the application and the access level.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is a valid identity type that can be granted an IAM role?

   • AA VPC network
   • BA firewall rule
   • CA Cloud Storage bucket
   • DA Google Group
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   An administrator wants to configure a PAM grant that requires a manager's approval before an engineer can receive elevated access. Where is this approval requirement configured?

   • AIn the IAM policy for the project.
   • BIn the Access Context Manager policy.
   • CIn the VPC firewall rules.
   • DIn the PAM entitlement configuration.
   Reveal Solution Discussion Select an answer first