Your organization uses Active Directory to authenticate users. Users' Google account access must be removed when their Active Directory account is terminated. How should your organization meet this…

Question

Options

• AConfigure two-factor authentication in the Google domain
• BRemove the Google account from all IAM policies
• CConfigure BeyondCorp and Identity-Aware Proxy in the Google domain
• DConfigure single sign-on in the Google domain

• A
  2% (1)
• B
  6% (3)
• C
  10% (5)
• D
  82% (42)

Explanation

Configuring Single Sign-On (SSO) between the Google domain and Active Directory (using Google Cloud Directory Sync and SAML federation) means Google authentication is delegated to Active Directory as the identity provider. When an employee's Active Directory account is disabled or terminated, they can no longer authenticate via SSO, which immediately revokes their access to all Google services. This provides automatic, centralized access revocation. Option B (removing from IAM policies) would be a manual, error-prone process across every policy. Option A (two-factor authentication) adds a security layer but doesn't automate deprovisioning. Option C (BeyondCorp/IAP) controls access to specific applications but doesn't centrally revoke Google account authentication.

No community discussion yet for this question.