Your company has been creating users manually in Cloud Identity to provide access to Google Cloud resources. Due to continued growth of the…

The goal is to make the on-premises LDAP server the single source of truth for users and groups while disabling, not deleting, manually created accounts in Cloud Identity. Configuring GCDS to "suspend domain users not found in LDAP" achieves this by deactivating accounts that don't exist in the authoritative source, which is a reversible and safe action. Setting up a recurring GCDS task (e.g., using a cron job or scheduler) ensures that lifecycle changes (new hires, terminations) in LDAP are automatically and continuously replicated to Cloud Identity.

B. Deleting users is a permanent action that can lead to data loss if the user owned resources. Suspending is the recommended, safer practice for disabling accounts.
C. Excluding manually created users from the search is the opposite of the requirement; the goal is to find these users and disable them.
D. This option incorrectly suggests excluding the target users and also implies manual sync runs, which is inefficient for ongoing lifecycle management.

1. Google Cloud Documentation, "Decide on a user deletion policy," for GCDS states, "You can set up a sync that suspends or deletes Google users that aren't in your LDAP directory... We recommend you suspend users." (support.google.com/a/topic/2679497, specifically in GCDS admin guides)

2. Google Cloud Documentation, "Automate your syncs," for GCDS recommends, "To keep your Google data in sync with your LDAP server, we recommend you automate the sync process... You can use any command-line tool that can run the sync-cmd command." (support.google.com/a/answer/6258335)