QuestionQ15

Configuring access and security

During a recent audit of your existing Google Cloud resources, you discovered several users with email addresses outside of your Google Workspace domain. You want to ensure that your resources are only shared with users whose email addresses match your domain. You need to remove any mismatched users, and you want to avoid having to audit your resources to identify mismatched users. What should you do?

  • A Create a Cloud Scheduler task to regularly scan your projects and delete mismatched users.
  • B Create a Cloud Scheduler task to regularly scan your resources and delete mismatched users.
  • C Set an organizational policy constraint to limit identities by domain to automatically remove mismatched users.
  • D Set an organizational policy constraint to limit identities by domain, and then retroactively remove the existing mismatched users
Explanation

Organization policy constraints for domain restriction are not retroactive—they apply only to new IAM policy changes. To ensure all current users comply, you must set the constraint and then manually remove existing mismatched users. This two-step process prevents future violations while cleaning the current state.

Community Discussion

No comments yet. Be the first to start the discussion!