Configuring access — PCSE Practice Quiz

Question 1

A company uses Okta as its primary identity provider and Google Cloud with Cloud Identity for its cloud resources. The security team wants new employees added in Okta to be automatically created as Cloud Identity users, and departing employees to be automatically suspended in Cloud Identity when disabled in Okta — all without deploying or maintaining any server infrastructure on-premises. Which approach should they implement?

Accepted Answer

Configure automated user provisioning in Okta using the SCIM-based Google Cloud/Google Workspace provisioning integration to push user lifecycle changes to Cloud Identity

Answer

Deploy Google Cloud Directory Sync (GCDS) on a Compute Engine VM and schedule it to sync the Okta user directory to Cloud Identity

Answer

Enable SAML SSO between Okta and Cloud Identity, which automatically provisions and deprovisions users on each sign-in event

Answer

Write a custom script using the Directory API and run it as a cron job on an on-premises server to poll Okta and update Cloud Identity

Question 2

Your organization uses an on-premises Active Directory as the authoritative source for identities. You have deployed Google Cloud Directory Sync (GCDS) to provision users into Cloud Identity, and SSO is federated to your AD FS provider via SAML. An employee is terminated and their account is disabled in Active Directory. Security requires that this person can no longer authenticate to any Google Cloud resource. What is the correct outcome you should expect and configure to guarantee immediate loss of access?

Accepted Answer

Because SSO is federated, disabling the AD account alone blocks new sign-ins, but you should also suspend or delete the Cloud Identity user via GCDS and revoke existing OAuth/session tokens to terminate active sessions.

Answer

Deleting the user only in the Google Admin console is sufficient, because GCDS will detect the deletion and prevent re-creation on the next sync.

Answer

Removing all IAM role bindings for the user's email in the affected projects is the only step needed, since IAM policy fully controls authentication.

Answer

Rotating the SAML signing certificate in Cloud Identity will immediately invalidate the terminated user's access without affecting other users.

Question 3

A financial services company uses Cloud Identity as its identity provider and has hundreds of employees who frequently change roles between the 'Data Analysts', 'Data Engineers', and 'Auditors' teams. The security team is frustrated because IAM bindings are granted directly to individual user accounts, causing access drift and lengthy offboarding when people move teams. They want a scalable approach that lets access follow team membership and simplifies audits. What should they implement?

Accepted Answer

Create Google Groups in Cloud Identity for each team, grant IAM roles to the groups at the appropriate resource level, and manage access by adjusting group membership.

Answer

Grant each user the Owner role at the organization level and use IAM Conditions to restrict what resources they can touch based on job title attributes.

Answer

Create a separate service account for each team and have employees impersonate the relevant service account when they need access.

Answer

Assign IAM roles directly to individual users but automate the binding changes with a nightly script that reconciles a spreadsheet of team assignments.

Question 4

Your organization already manages employee identities in an on-premises Active Directory and a third-party identity provider (Okta) that supports SAML 2.0. Leadership wants employees to sign in to Google Cloud using their existing Okta credentials, and wants Okta to remain the authoritative source for authentication. You must ensure that when users authenticate, they are redirected to Okta and that Google Cloud does not store or validate their passwords. What should you configure?

Accepted Answer

Configure Cloud Identity with third-party SSO by setting Okta as the SAML identity provider (IdP) and Cloud Identity as the service provider (SP).

Answer

Enable Google Cloud Directory Sync (GCDS) and let it synchronize password hashes from Active Directory to Cloud Identity.

Answer

Create all users manually in the Cloud Identity Admin console and enforce 2-Step Verification for each account.

Answer

Configure workload identity federation so Okta issues tokens that map to Google Cloud service accounts for each employee.

Question 5

Your organization recently adopted Google Cloud with Cloud Identity. The security team is concerned that the highly privileged super administrator accounts could be phished or compromised, leading to a full takeover of the Google Cloud organization. Which combination of practices best protects these super admin accounts while keeping them available for emergency use?

Accepted Answer

Enforce hardware security key 2-Step Verification on the super admin accounts, use them only for break-glass tasks, and delegate day-to-day administration through IAM roles on separate accounts

Answer

Assign the Organization Administrator IAM role to all daily administrator accounts and disable the built-in super admin accounts entirely

Answer

Enable SMS-based 2-Step Verification on the super admin accounts and share the credentials in a team password manager for availability

Answer

Grant each engineer their own super admin account so that access is auditable per individual and no shared credentials exist

Question 6

A data governance team needs a group of auditors to list all Cloud Storage buckets in a project and view each bucket's IAM policy and configuration metadata, but they must NOT be able to read the objects stored inside any bucket. The security engineer wants to grant the narrowest possible access. Which approach best satisfies least privilege?

Accepted Answer

Create a custom role containing only storage.buckets.list, storage.buckets.get, and storage.buckets.getIamPolicy permissions, and grant it to the auditors group at the project level.

Answer

Grant the auditors group the predefined roles/storage.objectViewer role at the project level.

Answer

Grant the auditors group the predefined roles/storage.admin role at the project level.

Answer

Grant the auditors group roles/viewer at the project level so they can inspect all resources read-only.

Question 7

A financial services company uses Google Cloud across an organization node. During a security review, the team discovers that engineers have been sharing Cloud Storage buckets and IAM roles with Gmail accounts and external contractor domains. Leadership mandates that going forward, IAM policies may only grant access to identities belonging to the company's own Cloud Identity account and one approved partner's Cloud Identity account. Which approach enforces this requirement across all current and future projects with the least ongoing maintenance?

Accepted Answer

Apply the 'Domain restricted sharing' (iam.allowedPolicyMemberDomains) organization policy at the organization node, listing the customer IDs of both the company and the approved partner.

Answer

Create an IAM deny policy at the organization node that blocks setIamPolicy for any principal outside the company domain.

Answer

Write an IAM condition on every bucket that evaluates the requesting principal's email domain and rejects non-approved domains.

Answer

Enable the 'Disable service account key creation' organization policy and audit external grants weekly using Cloud Asset Inventory.

Question 8

Your company runs its CI/CD pipeline on an external SaaS platform (GitHub Actions) that is outside Google Cloud. The pipeline needs to deploy artifacts to a Cloud Storage bucket and update a Cloud Run service in your Google Cloud project. Your security team has a strict policy prohibiting the creation and download of long-lived service account keys. What is the most secure approach to grant the external pipeline access to these Google Cloud resources?

Accepted Answer

Configure a workload identity pool and provider that trusts GitHub's OIDC tokens, then grant the pipeline's identity the ability to impersonate a service account with the required roles.

Answer

Create a service account, generate a JSON key, and store it as an encrypted secret in the GitHub Actions repository.

Answer

Create a Google user account for the pipeline, enable 2-step verification, and store the credentials in the CI/CD platform's secret manager.

Answer

Grant the GitHub Actions IP ranges access through a VPC firewall rule and assign roles directly to those IP addresses.

Question 9

A data analytics team at your company needs to run and manage BigQuery jobs and query datasets in a shared project. A junior engineer proposes granting the team's Google group the roles/editor basic role on the project so the work is unblocked quickly. Your security team requires that all access follow least privilege while still enabling the team to fully perform their BigQuery work. What should you recommend?

Accepted Answer

Grant the group the predefined roles/bigquery.user and roles/bigquery.dataEditor (or dataViewer) roles scoped to the appropriate BigQuery resources.

Answer

Grant the group roles/editor at the project level but add an IAM condition restricting it to BigQuery API calls.

Answer

Grant the group roles/owner on the project so they can manage BigQuery resources and IAM as needed.

Answer

Grant each individual engineer roles/editor directly rather than the group to reduce the blast radius.

Question 10

A financial services company runs a production project in Google Cloud. During a scheduled quarterly maintenance window, a contractor named Dana needs the ability to restart Compute Engine instances, but only for a 48-hour period this weekend. Company policy mandates least privilege and prohibits granting standing access to contractors. Dana already has a Cloud Identity account. What is the most appropriate way to grant this access?

Accepted Answer

Add an IAM binding granting Dana the roles/compute.instanceAdmin.v1 role with an IAM Condition that limits the grant to the specific date/time range of the maintenance window.

Answer

Grant Dana the roles/compute.instanceAdmin.v1 role at the project level and remove the binding manually after the maintenance window ends.

Answer

Create a service account with roles/compute.instanceAdmin.v1, generate a key, and give the key to Dana for the duration of the window.

Answer

Grant Dana the roles/owner role temporarily so she can restart the instances and revoke it after the weekend.

Question 11

Your organization has thousands of projects and a broad set of principals who hold roles that include storage.buckets.delete and compute.instances.delete permissions through various inherited and directly-granted IAM roles. Security leadership mandates that no principal — regardless of any role grant, including at the project level — may delete Cloud Storage buckets across the entire organization, except for a break-glass group named org-admins@example.com. You want a centrally enforced control that overrides existing allow grants without editing every role or policy. What should you do?

Accepted Answer

Create an IAM deny policy attached at the organization node that denies storage.buckets.delete for all principals, with a denial exception for the org-admins@example.com group.

Answer

Create a custom role that excludes storage.buckets.delete and reassign every principal to that custom role across all projects.

Answer

Apply the constraints/storage.uniformBucketLevelAccess organization policy constraint at the organization node to prevent bucket deletion.

Answer

Add an IAM condition to each allow binding that evaluates the resource type and blocks deletion actions on buckets.

Question 12

A security engineer at a retail company reviews an IAM issue. A developer, dev@example.com, unexpectedly has the ability to view logs in the project 'prod-payments'. The engineer confirms the project-level IAM policy for 'prod-payments' does NOT grant dev@example.com any role. However, the developer can still read logs. Which of the following is the MOST likely explanation and where the engineer should look next?

Accepted Answer

IAM policies are inherited down the resource hierarchy; dev@example.com was likely granted the Logs Viewer or a broader role at the organization or a parent folder level, and that binding is additive to the project policy.

Answer

Project-level IAM policies always override parent bindings, so the engineer should re-check the project policy because inherited roles cannot grant access when the project policy is empty.

Answer

The developer must have a service account key for the project; the engineer should rotate the key to remove the log-reading access.

Answer

An organization policy constraint is granting the log access, so the engineer should modify the org policy to deny logging for the developer.

Question 13

A data analyst reports she can no longer download objects from a Cloud Storage bucket named 'analytics-exports' in the project 'data-prod'. She belongs to three Google Groups, and IAM bindings exist at the organization, folder, and project levels. You need to determine exactly which allow or deny policy is granting or blocking her 'storage.objects.get' permission on that specific bucket, with the least manual effort. What should you do?

Accepted Answer

Use IAM Policy Troubleshooter, specifying the analyst's principal, the bucket resource, and the 'storage.objects.get' permission to see the evaluated access and the contributing bindings.

Answer

Export all IAM allow policies at the organization, folder, and project levels with 'gcloud' and manually inspect each binding to find the analyst's group memberships.

Answer

Enable Data Access audit logs for Cloud Storage and search Cloud Logging for the analyst's denied requests to identify the missing role.

Answer

Run 'gcloud projects get-iam-policy data-prod' and check whether the analyst is directly listed with the Storage Object Viewer role.

Question 14

A security engineer at a financial services company is performing a quarterly access review. A data analyst was granted the roles/editor role on the analytics project six months ago, but audit logs show they have only ever read BigQuery datasets and viewed Cloud Storage objects. Leadership wants to enforce least privilege while avoiding disruption to the analyst's legitimate work. Which approach should the engineer use to most efficiently right-size this access based on actual usage?

Accepted Answer

Use IAM Recommender role recommendations, which analyze the last 90 days of usage to suggest replacing the broad role with less-permissive roles that cover observed activity.

Answer

Immediately remove the analyst's IAM binding entirely and wait for them to file access requests for any permissions they discover they need.

Answer

Create a custom role that includes every permission contained in roles/editor and assign it so the analyst retains identical access.

Answer

Apply an IAM deny policy that blocks write operations while leaving the roles/editor grant in place so no permissions need to be re-evaluated.

Question 15

A company organizes its GCP resources with an organization node, a 'Production' folder, and a 'Sandbox' folder. At the organization level, the security team sets the 'constraints/compute.vmExternalIpAccess' list constraint to deny all values, preventing external IPs on VMs. The development team needs VMs with external IPs only within a specific project inside the 'Sandbox' folder for a public demo, without weakening the restriction anywhere else. What is the most appropriate way to achieve this?

Accepted Answer

Set an organization policy on the specific demo project that overrides the inherited policy by allowing the required VM instances' external IP values.

Answer

Remove the organization-level policy and re-apply the deny constraint on the 'Production' folder only, leaving 'Sandbox' unrestricted.

Answer

Grant the development team the 'roles/orgpolicy.policyAdmin' role at the organization level so they can adjust the constraint as needed.

Answer

Add an IAM deny policy at the project level to explicitly permit external IP assignment for the demo VMs.

Question 16

Your company runs a production billing project in Google Cloud that contains critical revenue-processing resources. Leadership is concerned that an engineer with the Owner role could accidentally delete the entire project. Security must ensure that no one can delete this specific project until an explicit protective control is removed, while still allowing normal day-to-day resource management to continue. Which action best meets this requirement?

Accepted Answer

Place a project lien on the billing project so that deletion attempts are blocked until the lien is removed.

Answer

Remove the Owner role from all engineers and grant only the Editor role to prevent project deletion.

Answer

Apply an organization policy constraint that restricts project creation across the organization.

Answer

Enable a deny policy that blocks all resourcemanager.projects.* permissions for the engineering group.

Question 17

A financial services company must ensure that all Compute Engine and Cloud Storage resources are created only in European regions to meet data residency requirements. The security team wants a preventive control enforced across the entire organization that blocks resource creation in any non-approved region, without relying on developers to remember the policy. Which approach best meets this requirement?

Accepted Answer

Apply the 'gcp.resourceLocations' organization policy list constraint at the organization node, setting allowed values to the approved European locations.

Answer

Create a custom IAM role that grants resource creation permissions only when the region attribute matches an approved European value.

Answer

Write a Cloud Function triggered by audit logs that deletes any resource detected in a non-European region.

Answer

Add an IAM deny policy at the organization level that denies all resource creation actions outside European regions.

Question 18

Your organization has a folder named 'production' containing dozens of projects. Security requires that Compute Engine VMs may only be created with Shielded VM enabled, but a separate 'sandbox' folder must remain exempt so engineers can test legacy images. You want to enforce this using organization policy with the least ongoing administrative effort and without modifying individual project configurations. What should you do?

Accepted Answer

Apply the boolean constraint 'constraints/compute.requireShieldedVm' with 'enforced: true' at the 'production' folder, and leave the 'sandbox' folder at the default (not enforced).

Answer

Apply the boolean constraint 'constraints/compute.requireShieldedVm' with 'enforced: true' at the organization node, and add each sandbox project as an exception in the policy's condition list.

Answer

Create a custom IAM deny policy on the 'production' folder that blocks 'compute.instances.create' unless the request includes a Shielded VM attribute.

Answer

Enable the list constraint 'constraints/compute.trustedImageProjects' at the organization and manually audit VM creation logs in the sandbox folder.

Question 19

A financial services company has a Google Cloud organization with a dedicated 'networking' folder containing Shared VPC host projects. The security team discovers that a developer in a separate 'apps' folder was able to attach their service project to a Shared VPC host project without approval. The team wants to ensure that only specifically designated host projects can be used as Shared VPC hosts across the organization, blocking all others by default. Which approach should they take?

Accepted Answer

Apply the 'constraints/compute.restrictSharedVpcHostProjects' list constraint at the organization node, denying all host projects, and add an allow entry for only the approved host project resource IDs

Answer

Grant the 'roles/compute.xpnAdmin' role only to the networking team at the folder level and remove it from all other principals

Answer

Enable the 'constraints/compute.disableSerialPortAccess' boolean constraint on the apps folder to prevent unauthorized service project attachment

Answer

Create an IAM deny policy that blocks the 'compute.subnetworks.setPrivateIpGoogleAccess' permission for all developers in the apps folder

Question 20

A financial services company runs all production workloads in a single GCP folder called 'prod'. A recent audit found that several Compute Engine VMs were created with external IP addresses, violating the company's policy that production instances must only be reachable through internal networking and Cloud NAT. The security team wants to prevent any future VM in the 'prod' folder from being assigned an external IP, while allowing developers in a separate 'sandbox' folder to continue using external IPs for testing. What is the most effective way to enforce this?

Accepted Answer

Apply the 'constraints/compute.vmExternalIpAccess' list constraint at the 'prod' folder with an empty allowed values list to deny all external IPs, and leave the 'sandbox' folder unaffected.

Answer

Create a custom IAM role without the compute.instances.create permission and assign it to all developers in the 'prod' folder.

Answer

Apply the 'constraints/compute.vmExternalIpAccess' constraint at the organization node with 'Deny All' so it is inherited everywhere.

Answer

Configure a VPC firewall rule in the 'prod' projects to block all ingress traffic from external IP ranges.

More PCSE practice