CLOUD-SECURITY-ENGINEER practice question 7 of 35

You are a security administrator at your company. Per Google-recommended best practices, you implemented the domain restricted sharing organization…

You are a security administrator at your company. Per Google-recommended best practices, you implemented the domain restricted sharing organization policy to allow only required domains to access your projects. An engineering team is now reporting that users at an external partner outside your organization domain cannot be granted access to the resources in a project. How should you make an exception for your partner's domain while following the stated best practices?

Answer options

A: Turn off the domain restriction sharing organization policy. Set the policy value to "Allow All."

B: Turn off the domain restricted sharing organization policy. Provide the external partners with the required permissions using Google's Identity and Access Management (IAM) service.

C: Turn off the domain restricted sharing organization policy. Add each partner's Google Workspace customer ID to a Google group, add the Google group as an exception under the organization policy, and then turn the policy back on.

D: Turn off the domain restricted sharing organization policy. Set the policy value to "Custom." Add each external partner's Cloud Identity or Google Workspace customer ID as an exception under the organization policy, and then turn the policy back on. Correct answer

Correct Answer:

D. Turn off the domain restricted sharing organization policy. Set the policy value to "Custom." Add each external partner's Cloud Identity or Google Workspace customer ID as an exception under the organization policy, and then turn the policy back on.

Explanation

The "domain restricted sharing" organization policy is the correct tool to control which domains can be added to IAM policies. To allow a specific external partner, you should not disable the policy. Instead, you modify the policy constraint, set its value to "Custom," and add the external partner's unique Google Workspace or Cloud Identity customer ID to the list of allowed domains. This maintains the security posture for all other projects while creating a specific exception for the partner.

Why Incorrect

A. Setting the policy to "Allow All" completely negates the security benefit of restricting domains and goes against the principle of least privilege.
B. Turning off the policy removes a critical, organization-wide security control, which is not a recommended best practice for making a single exception.
C. The domain restriction policy uses Google Workspace or Cloud Identity customer IDs for exceptions, not Google Groups. This option describes an incorrect mechanism.

References

1. Google Cloud Documentation, Organization Policy Constraints, "Restricting identities by domain". This page details the iam.allowedPolicyMemberDomains constraint and explicitly states: "To set exceptions, get the Cloud Identity or Google Workspace customer ID for the organization that you want to add."

2. Google Cloud Documentation, "Allowing specific external domains". This section within the "Restricting identities by domain" guide provides a step-by-step tutorial, showing the process of finding a customer ID and adding it to a custom organization policy.

Keep practicing

Take the free CLOUD-SECURITY-ENGINEER practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test