Question

Your organization recently adopted Google Cloud with Cloud Identity. The security team is concerned that the highly privileged super administrator accounts could be phished or compromised, leading to a full takeover of the Google Cloud organization. Which combination of practices best protects these super admin accounts while keeping them available for emergency use?

Accepted Answer

Enforce hardware security key 2-Step Verification on the super admin accounts, use them only for break-glass tasks, and delegate day-to-day administration through IAM roles on separate accounts

Answer

Assign the Organization Administrator IAM role to all daily administrator accounts and disable the built-in super admin accounts entirely

Answer

Enable SMS-based 2-Step Verification on the super admin accounts and share the credentials in a team password manager for availability

Answer

Grant each engineer their own super admin account so that access is auditable per individual and no shared credentials exist