1.4 Managing and Implementing Authorization Controls PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   An organization wants to ensure that the person who creates a service account is not the same person who can grant that service account access to resources. Which principle does this practice enforce?

   • ADefense in depth
   • BSeparation of duties
   • CLeast privilege
   • DZero trust
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the primary difference between IAM and legacy Access Control Lists (ACLs) in Google Cloud?

   • AIAM grants access to identities, while ACLs grant access to specific users or groups for individual objects.
   • BIAM permissions are permanent, while ACL permissions expire automatically.
   • CIAM is used for Cloud Storage only, while ACLs are used for all other Google Cloud services.
   • DIAM is used for users, while ACLs are used for service accounts.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   Your organization has a folder-level policy that grants the Storage Admin role to a group of data scientists. A specific user in that group should not be able to delete any storage buckets, even though the group policy allows it. You need to explicitly prevent this user from deleting buckets while preserving all other group permissions. What should you do?

   • ACreate a new group with the Storage Admin role and add all users except the specific user.
   • BGrant the user the Storage Admin role at the project level and remove the folder-level binding.
   • CRemove the user from the group and grant them the Storage Object Viewer role.
   • DCreate an IAM deny policy at the folder level that denies the storage.buckets.delete permission for that user.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   An organization wants to ensure that no user, including project owners, can delete a specific critical bucket. Which IAM feature should be used?

   • AAn IAM deny policy that denies the storage.buckets.delete permission for all users on that bucket.
   • BA custom role with the storage.buckets.delete permission removed.
   • CA VPC Service Controls perimeter that blocks all access to the bucket.
   • DAn IAM condition on the Owner role that prevents deletion after business hours.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the primary use case for Privileged Access Manager (PAM)?

   • ATo replace IAM for all access control decisions.
   • BTo provide permanent, standing access to privileged roles for administrators.
   • CTo manage access to a single resource, like a specific VM.
   • DTo grant just-in-time, time-bound access to privileged roles with optional approval.
   Reveal Solution Discussion Select an answer first