CLOUD-SECURITY-ENGINEER practice question 12 of 35

Your team wants to centrally manage GCP IAM permissions from their on-premises Active Directory Service. Your team wants to manage permissions by AD group membership. What should your team do to meet these requirements?

Full set: 317 questions

Answer options

A: Set up Cloud Directory Sync to sync groups, and set IAM permissions on the groups. Correct answer

B: Set up SAML 2.0 Single Sign-On (SSO), and assign IAM permissions to the groups.

C: Use the Cloud Identity and Access Management API to create groups and IAM permissions from Active Directory.

D: Use the Admin SDK to create groups and assign IAM permissions from Active Directory.

Correct Answer:

A. Set up Cloud Directory Sync to sync groups, and set IAM permissions on the groups.

Explanation

The requirement is to federate identities from an on-premises Active Directory (AD) and use AD groups to manage Google Cloud IAM permissions. Google Cloud Directory Sync (GCDS) is the purpose-built tool for this. GCDS synchronizes users and, critically, groups from AD into a Cloud Identity domain. Once the groups exist as Google Groups within Cloud Identity, you can assign IAM roles to these groups. This allows you to manage permissions centrally by adding or removing users from the corresponding groups in your on-premises AD.

Why Incorrect

B. SAML 2.0 SSO handles authentication (verifying user identity) but does not synchronize group memberships for use in IAM policies.
C. Using the IAM API directly would require building and maintaining a custom synchronization script, which is less robust than the managed GCDS solution.
D. The Admin SDK is a programmatic tool for managing Google Workspace/Cloud Identity; using it would also require a custom solution instead of the standard GCDS tool.

References

1. Google Cloud Documentation

"Google Cloud Directory Sync"

Section: "Overview". It states

"GCDS enables you to synchronize your users and groups from an existing Active Directory... to your Google Cloud directory."

2. Google Cloud Documentation

"Federating Google Cloud with Active Directory"

Section: "Authorizing users with groups". This section explicitly describes the architecture: "You use Google Cloud Directory Sync (GCDS) to synchronize groups from Active Directory to Cloud Identity." and "In Google Cloud

you grant IAM roles to the synchronized groups."

3. Google Cloud Documentation

"Best practices for federating Google Cloud with an external identity provider"

Section: "Synchronize users and groups". This document recommends using a provisioning tool like GCDS to synchronize users and groups for authorization purposes.

Keep practicing

Take the free CLOUD-SECURITY-ENGINEER practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test