Professional Cloud Security EngineerDemo

By Google · Question Mode

QuestionQ227

Configuring access

You work for a large organization in which every business unit has thousands of users. You must delegate access-control permission management to each business unit. You have these requirements:

  • Each business unit manages access controls for its own projects.
  • Each business unit manages access-control permissions at scale.
  • Business units must not be able to access other business units' projects.
  • Users lose access when they move to another business unit or leave the company.
  • The on-premises directory service manages users and access-control permissions.

What should you do?

Choose two
  • A Use VPC Service Controls to create perimeters around each business unit's project.
  • B Organize projects in folders, and assign permissions to Google groups at the folder level.
  • C Group business units based on Organization Units (OUs) and manage permissions based on OUs
  • D Create a project naming convention, and use Google's IAM Conditions to manage access based on the prefix of project names.
  • E Use Google Cloud Directory Sync to synchronize users and group memberships in Cloud Identity.
Explanation

Folders create administrative boundaries in the Google Cloud resource hierarchy, and IAM roles granted to Google groups at a folder are inherited by its projects. This enables business-unit-specific, scalable access control through group membership. Google Cloud Directory Sync synchronizes users and group memberships from an on-premises directory to Cloud Identity, so directory membership changes revoke inherited access for transfers and departing users.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!