CLOUD-SECURITY-ENGINEER practice question 3 of 35

You work for a large organization where each business unit has thousands of users. You need to delegate management of access control permissions to…

You work for a large organization where each business unit has thousands of users. You need to delegate management of access control permissions to each business unit. You have the following requirements: Each business unit manages access controls for their own projects. Each business unit manages access control permissions at scale. Business units cannot access other business units' projects. Users lose their access if they move to a different business unit or leave the company. Users and access control permissions are managed by the on-premises directory service. What should you do? (Choose two.)

Answer options

A: Use VPC Service Controls to create perimeters around each business unit's project.

B: Organize projects in folders, and assign permissions to Google groups at the folder level. Correct answer

C: Group business units based on Organization Units (OUs) and manage permissions based on OUs.

D: Create a project naming convention, and use Google's IAM Conditions to manage access based on the prefix of project names.

E: Use Google Cloud Directory Sync to synchronize users and group memberships in Cloud Identity. Correct answer

Correct Answer:

B. Organize projects in folders, and assign permissions to Google groups at the folder level.; E. Use Google Cloud Directory Sync to synchronize users and group memberships in Cloud Identity.

Explanation

This scenario requires a scalable and delegated access management model integrated with an on-premises directory. Using Google Cloud Directory Sync (GCDS) (E) synchronizes users and, crucially, group memberships from the on-premises directory to Cloud Identity. Organizing projects into folders by business unit and assigning IAM permissions to the synchronized Google groups at the folder level (B) provides a scalable and isolated delegation model. When a user's group membership changes on-premises, GCDS syncs the change, and their access to Google Cloud resources is automatically updated, fulfilling all requirements.

Why Incorrect

A. VPC Service Controls create data exfiltration perimeters around projects; they do not manage IAM permissions for user access control.
C. Organization Units (OUs) in Cloud Identity are for applying policies to users (e.g., 2FA requirements), not for grouping resources or granting IAM permissions.
D. Using IAM Conditions based on project names is less scalable and more error-prone than using the resource hierarchy with folders for managing permissions.

References

1. Google Cloud Documentation, "Resource hierarchy". Section "Using the resource hierarchy for access control". This section explains that folders can be used to group resources that share common IAM policies, ideal for mapping to organizational structures like business units.

2. Google Cloud Documentation, "About Google Cloud Directory Sync". This document explains that GCDS synchronizes data, including users and groups, from an external directory service to Google Cloud, enabling centralized identity management.

3. Google Cloud Documentation, "IAM overview". This document describes how permissions are granted to principals (users, groups) on resources and how the resource hierarchy (folders) allows for policy inheritance.

Keep practicing

Take the free CLOUD-SECURITY-ENGINEER practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test