You are a Cloud Identity administrator for your organization. In your Google Cloud environment, groups are used to manage user permissions. Each application team has a dedicated group. Your team is…

Question

Options

• AChange the configuration of the relevant groups in the Google Workspace Admin console to
• BSet an Identity and Access Management (IAM) policy that includes a condition that restricts group
• CDefine an Identity and Access Management (IAM) deny policy that denies the assignment of
• DExport the Cloud Identity logs to BigQuery. Configure an alert for external members added to

• A
  80% (16)
• B
  5% (1)
• C
  10% (2)
• D
  5% (1)

Explanation

Google Groups (managed through Cloud Identity / Google Workspace) have a 'Who can join the group' and 'Who can be added as a member' setting that can be configured to restrict membership to users within the organization's domain only. By changing this configuration in the Google Workspace Admin console (A), you enforce at the group level that application teams can only add internal users, regardless of which interface they use. This is the correct, purpose-built control for this requirement. Option B (IAM condition on group membership) is not a valid IAM condition type - IAM conditions apply to resource access, not group membership management. Option C (IAM deny policy) cannot restrict the domain of users being added to a group. Option D (export logs and alert) is a detective control, not a preventive one - it alerts after the fact but does not block the action.

No community discussion yet for this question.