Professional Security Operations EngineerDemo

Question

Your company partners with an external Managed Service Provider (MSP) whose users must be able to list Security Command Center (SCC) findings by using the Google Cloud SDK. You need to configure the necessary access for the managed service provider while minimizing your involvement in managing their external user lifecycle. What should you do?

A Create a user account in your Cloud Identity instance using a subdomain indicating they are external to your organization. Grant this user account the appropriate IAM role at the organization level.
B Create a service account in a SCC project. Grant the MSP user permission to impersonate this account. Grant this service account the appropriate IAM role at the organization level.
C Create a workload identity pool in a SCC project. Grant the MSP user the permission to impersonate a service account from this pool, and grant the service account the appropriate IAM role at the organization level.
D Create a workforce identity pool and federate with the identity provider (IdP) of the managed service provider. Grant users of the MSP the appropriate IAM role at the organization level.

Explanation

Workforce Identity Federation lets external workforce users, including partners and contractors, authenticate through their own identity provider and access Google Cloud through the CLI and APIs. Because identities are federated rather than created or synchronized as Cloud Identity accounts, the MSP retains responsibility for its users’ lifecycle. Granting the appropriate organization-level Security Command Center IAM role to the federated MSP principals provides the required findings-listing access.

Learn more

Professional Security Operations EngineerDemo

AstroTutor

Notes

Readiness

QuestionQ102

Community Discussion