A company uses GCDS to sync users from Active Directory to Cloud Identity. They have a requirement that when an employee is terminated, their access to Google Cloud must be revoked within 15 minutes. GCDS runs every hour. What should they do to meet this requirement?

Use Workforce Identity Federation to immediately revoke access.

Increase the GCDS sync frequency to every 10 minutes.

Use the Admin SDK to immediately suspend the user's account when the termination is processed in AD.

Configure GCDS to delete users when they are removed from AD, and rely on the next sync.

An organization wants to ensure that the super administrator account is not a single point of failure. They want to have multiple administrators who can perform critical tasks, but they also want to minimize the risk of compromise. What should they do?

Use a single super administrator account and share the password with a few trusted IT staff.

Create multiple super administrator accounts and enforce two-step verification on all of them.

Create a service account with super admin privileges and use it for all administrative tasks.

Use a break-glass account and store the password in a secure vault, but do not use it regularly.

A company wants to allow its external contractors to access specific Google Cloud resources using their own corporate identity provider credentials. The contractors are not employees and do not have accounts in the company's Cloud Identity. What should they configure?

Create user accounts for the contractors in Cloud Identity and set up SAML SSO.

Use the Admin SDK to create temporary accounts for the contractors.

Use GCDS to sync the contractors from their identity provider into Cloud Identity.

Configure Workforce Identity Federation to trust the contractors' identity provider.

A security engineer needs to synchronize users and groups from an on-premises Active Directory into Google Cloud Identity. Which tool is designed specifically for this purpose?

Google Cloud Directory Sync (GCDS)

Cloud Identity-Aware Proxy (IAP)

A company wants to allow its employees to access Google Cloud using SSO with their corporate IdP. They also want to allow external partners to access a specific project using Workforce Identity Federation. They want to ensure that employees cannot use Workforce Identity Federation to access resources. What should they do?

Use GCDS to sync employees and partners, and then use IAM to restrict access.

Configure Workforce Identity Federation with a condition that only allows external identity providers, and restrict the pool to partners.

Create separate projects for employees and partners, and use IAM policies to restrict access.

Use SAML SSO for employees and do not configure Workforce Identity Federation.

Google CloudProfessional Cloud Security Engineer

Domain 1Objective 1

1.1 Managing Cloud Identity PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 3)

Part of the Configuring access domain, which accounts for 25% of the PROFESSIONAL-CLOUD-SECURITY-ENGINEER exam.

23questions here

5free pages

6concepts

25%of the exam

Questions 11–15

11expert · hard
A company uses GCDS to sync users from Active Directory to Cloud Identity. They have a requirement that when an employee is terminated, their access to Google Cloud must be revoked within 15 minutes. GCDS runs every hour. What should they do to meet this requirement?
Select an answer first
12application · medium
An organization wants to ensure that the super administrator account is not a single point of failure. They want to have multiple administrators who can perform critical tasks, but they also want to minimize the risk of compromise. What should they do?
Select an answer first
13application · medium
A company wants to allow its external contractors to access specific Google Cloud resources using their own corporate identity provider credentials. The contractors are not employees and do not have accounts in the company's Cloud Identity. What should they configure?
Select an answer first
14foundation · easy
A security engineer needs to synchronize users and groups from an on-premises Active Directory into Google Cloud Identity. Which tool is designed specifically for this purpose?
Select an answer first
15expert · hard
A company wants to allow its employees to access Google Cloud using SSO with their corporate IdP. They also want to allow external partners to access a specific project using Workforce Identity Federation. They want to ensure that employees cannot use Workforce Identity Federation to access resources. What should they do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PROFESSIONAL-CLOUD-SECURITY-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Google Cloud. “PROFESSIONAL-CLOUD-SECURITY-ENGINEER” is a trademark of its owner, used for identification only.