Professional Cloud Security EngineerDemo

By Google · Question Mode

QuestionQ261

Configuring access

You are a Cloud Identity administrator for your organization. In your Google Cloud environment, groups are used to manage user permissions. Each application team has a dedicated group. Your team is responsible for creating these groups, and the application teams can manage their own team members through the Google Cloud console. You must ensure that application teams can add only users from within your organization to their groups.

What should you do?

  • A Change the configuration of the relevant groups in the Google Workspace Admin console to prevent external users from being added to the group.
  • B Set an Identity and Access Management (IAM) policy that includes a condition that restricts group membership to user principals that belong to your organization.
  • C Define an Identity and Access Management (IAM) deny policy that denies the assignment of principals that are outside your organization to the groups in scope.
  • D Export the Cloud Identity logs to BigQuery. Configure an alert for external members added to groups. Have the alert trigger a Cloud Function instance that removes the external members from the group.
Explanation

Google Groups settings control whether a group can contain external members. Configure each applicable group as internal by disabling the setting that allows members outside the organization; this prevents application-team group managers from adding external users. IAM allow policies and deny policies govern access to Google Cloud resources, not Google Group membership, and log-driven removal would detect violations only after they occur.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!