1.4 Managing and Implementing Authorization Controls PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is a service account in Google Cloud IAM?

   • AA role that grants access to a specific service.
   • BAn identity that is used by applications and virtual machines to authenticate to Google Cloud APIs.
   • CA group of users who share the same permissions.
   • DA special type of Google account that represents a human user.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   Your organization uses BeyondCorp Enterprise and IAM conditions. You need to grant a group of contractors access to a production application only when they are on the corporate network and during business hours (9 AM to 5 PM). You have created an access level in Access Context Manager that matches the corporate network. How should you enforce both the network and time restrictions?

   • AAdd an IAM condition to the role binding that requires the access level and the time to be within business hours.
   • BConfigure the access level to include the time restriction.
   • CUse VPC Service Controls to restrict access to the application during business hours.
   • DCreate two separate role bindings: one with the access level condition and another with the time condition.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is a key benefit of using Google Groups for IAM permission management?

   • AIt automatically grants the Owner role to all members of the group.
   • BIt simplifies access control by allowing permissions to be managed for a group rather than for each individual user.
   • CIt is the only way to grant access to external users.
   • DIt allows for more granular permissions than IAM roles.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which IAM role type is a collection of permissions that is predefined by Google Cloud and cannot be modified?

   • ACustom role
   • BPrimitive role
   • CPredefined role
   • DBasic role
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   Your company has a break-glass procedure that requires a senior engineer to have temporary access to the production project's admin roles during an emergency. The access must be time-limited and require approval from a manager. You need to implement a solution that meets these requirements. What should you use?

   • AAccess Context Manager with a device-based access level.
   • BIAM conditions with a time-based condition on the senior engineer's role.
   • CPrivileged Access Manager with a role grant that requires approval and has a duration limit.
   • DA custom role with the necessary permissions and a manual process to grant and revoke it.
   Reveal Solution Discussion Select an answer first