nerdexam
Google

PROFESSIONAL-CLOUD-SECURITY-ENGINEER · Question #28

Developers in an organization are prototyping a few applications on Google Cloud Platform (GCP) and are starting to store sensitive information on GCP. The developers are using their…

The correct answer is B. Set up Google Cloud Identity and require the developers to use those accounts for GCP work. Google Cloud Identity provides managed Google accounts under the organization's domain, giving the security team centralized control over user accounts, access policies, audit logs, and lifecycle management (e.g., deprovisioning when employees leave). Personal Gmail accounts…

Submitted by noor.lb· Apr 18, 2026Configuring access within a cloud solution environment

Question

Developers in an organization are prototyping a few applications on Google Cloud Platform (GCP) and are starting to store sensitive information on GCP. The developers are using their personal/consumer Gmail accounts to set up and manage their projects within GCP. A security engineer identifies this practice as a concern to the organization management because of the lack of centralized project management and access to the data being stored in these accounts. Which solution should be used to resolve this concern?

Options

  • AEnforce the setup of Security Keys as the 2SV method for those Gmail accounts.
  • BSet up Google Cloud Identity and require the developers to use those accounts for GCP work.
  • CRequire the developers to log/store their Gmail passwords with the Security team.
  • DEnable logging on all GCP projects to track all developer activities.

How the community answered

(19 responses)
  • A
    11% (2)
  • B
    74% (14)
  • D
    16% (3)

Explanation

Google Cloud Identity provides managed Google accounts under the organization's domain, giving the security team centralized control over user accounts, access policies, audit logs, and lifecycle management (e.g., deprovisioning when employees leave). Personal Gmail accounts offer none of these controls - the organization cannot enforce MFA policies, cannot revoke access to GCP projects centrally, and cannot audit activities across a unified identity. Enforcing 2SV on personal Gmail accounts (A) does not give the organization ownership or control. Storing passwords with the security team (C) is an anti-pattern. Enabling logging (D) provides visibility but does not address the root problem of unmanaged identities.

Topics

#Cloud Identity#Identity and Access Management (IAM)#Centralized identity management#Organizational best practices

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice