1.4 Managing and Implementing Authorization Controls PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   A developer needs temporary access to a production project for a maintenance window that is scheduled for next Tuesday from 2:00 AM to 4:00 AM. Which IAM feature should be used to enforce this time restriction?

   • AIAM deny policies
   • BPrivileged Access Manager
   • CAccess Context Manager
   • DIAM conditions
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which Policy Intelligence tool is used to identify IAM roles that have not been used in the last 90 days?

   • APolicy Analyzer
   • BValidator
   • CRecommender
   • DPolicy Troubleshooter
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   A security engineer needs to grant a specific user read access to a single object in a Cloud Storage bucket. Which method is the most appropriate for this task?

   • AGrant the user the roles/storage.objectViewer role on the project.
   • BAdd the user to the bucket's IAM policy with the roles/storage.objectViewer role.
   • CUse an ACL to grant the user read access to the specific object.
   • DCreate a new IAM role with the storage.objects.get permission and assign it to the user.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   A security team wants to reduce the risk of standing admin privileges by allowing engineers to request temporary access to the Owner role on a project. Which service is designed for this scenario?

   • AVPC Service Controls
   • BIAM Recommender
   • CPrivileged Access Manager
   • DAccess Context Manager
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   Your organization has multiple projects, and each project has a different set of users who need access to Cloud Storage buckets. You want to centralize access management so that when a user changes teams, their access is updated automatically across all projects. You also need to ensure that access is granted at the appropriate level to follow least privilege. What should you do?

   • AUse service accounts for each team and share the credentials.
   • BGrant roles directly to users at the organization level.
   • CCreate a custom role for each team and assign it to users at the folder level.
   • DCreate Google Groups for each team, grant the appropriate roles to the groups at the project level, and manage user membership in the groups.
   Reveal Solution Discussion Select an answer first