You are the Security Admin in your company. You want to synchronize all security groups that have an email address from your LDAP directory in Cloud IAM. What should you do?

Question

Options

• AConfigure Google Cloud Directory Sync to sync security groups using LDAP search rules that
• BConfigure Google Cloud Directory Sync to sync security groups using LDAP search rules that
• CUse a management tool to sync the subset based on the email address attribute. Create a group
• DUse a management tool to sync the subset based on group object class attribute. Create a group

• A
  72% (38)
• B
  4% (2)
• C
  17% (9)
• D
  8% (4)

Explanation

Google Cloud Directory Sync (GCDS) is the purpose-built Google tool for syncing LDAP/Active Directory data into Google Cloud IAM, making it the only correct tool for this task - Option A correctly pairs GCDS with an LDAP search rule filtered on the email address attribute, which precisely targets only groups that have an email address, matching the stated requirement.

Option B is wrong because, while it also uses GCDS, it likely filters by group object class rather than email address - this would sync all security groups regardless of whether they have an email, violating the scoping requirement.

Options C and D are wrong because they refer to a generic "management tool" instead of GCDS; Google's recommended and supported path for LDAP-to-IAM synchronization is specifically GCDS, not an arbitrary management tool.

Memory tip: Think "GCDS = Google's LDAP bridge" - whenever a GCP exam question asks about syncing from an external LDAP/AD directory into Google Cloud, GCDS is almost always the answer. Then match the filter to the requirement: syncing groups with email addresses → filter on the email attribute.

No community discussion yet for this question.