Professional Security Operations EngineerDemo

By Google · Question Mode

QuestionQ84

Platform operations

A company uses Cloud Identity to manage employee identities and has Google Security Operations (SecOps) linked to its Google Cloud project. The roles/chronicle.viewer IAM role has been assigned at the project level to a particular Google Group that includes users with external Google accounts. Those external-group users authenticate successfully to Google Cloud but cannot access Google SecOps, while internal users granted the same role can access Google SecOps.

Which Google Cloud configuration is most likely preventing the external users from accessing Google SecOps?

  • A External users must be synchronized to Cloud Identity using Google Cloud Directory Sync (GCDS) for IAM roles to take effect.
  • B Google SecOps inherently blocks sign-ins from identities outside the organization's primary domain.
  • C The constraints/iam.allowedPolicyMemberDomains organization policy is restricting IAM role assignments to identities within your company domain only.
  • D The roles/chronicle.viewer IAM role does not apply correctly when granted to Google Groups containing external identities.
Explanation

With Cloud Identity as the Google SecOps identity provider, access is based on managed enterprise accounts in the organization’s Cloud Identity domain. External Google accounts can authenticate to Google Cloud yet are not managed corporate identities for that Cloud Identity-based SecOps sign-in flow. The roles/chronicle.viewer role is supported for group assignments, and domain-restricted sharing evaluates a group’s domain rather than the domains of its members.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!