nerdexam
Google

PROFESSIONAL-CLOUD-SECURITY-ENGINEER · Question #286

Your organization is migrating a complex application to Google Cloud. The application has multiple internal components that interact with each other across several Google Cloud projects. Security is…

The correct answer is A. Identify the users who will migrate the application, revoke the default user roles and assign the. To implement an authorization scheme for administrators that adheres to least privilege and separation of duties, identify specific users, revoke broad default roles, and assign granular IAM roles at the lowest possible resource level.

Submitted by neha2k· Apr 18, 2026Configuring access within a cloud solution environment

Question

Your organization is migrating a complex application to Google Cloud. The application has multiple internal components that interact with each other across several Google Cloud projects. Security is a major concern, and you must design an authorization scheme for administrators that aligns with the principles of least privilege and separation of duties. What should you do?

Options

  • AIdentify the users who will migrate the application, revoke the default user roles and assign the
  • BUse multiple external identity providers (IdP) configured to use different SAML profiles and
  • CConfigure multi-factor authentication (MFA) to enforce the use of physical tokens for all users who
  • DNo action needed. When a Google Cloud organization is created, the appropriate permissions are

How the community answered

(46 responses)
  • A
    72% (33)
  • B
    15% (7)
  • C
    9% (4)
  • D
    4% (2)

Why each option

To implement an authorization scheme for administrators that adheres to least privilege and separation of duties, identify specific users, revoke broad default roles, and assign granular IAM roles at the lowest possible resource level.

AIdentify the users who will migrate the application, revoke the default user roles and assign theCorrect

Identifying specific users and assigning them the least-privileged, predefined or custom IAM roles at the lowest possible resource hierarchy level directly implements the principles of least privilege and separation of duties, ensuring administrators only have permissions necessary for their tasks and no more.

BUse multiple external identity providers (IdP) configured to use different SAML profiles and

Using multiple external identity providers and SAML profiles is about identity federation, not the granular authorization scheme or principles of least privilege and separation of duties for access to resources.

CConfigure multi-factor authentication (MFA) to enforce the use of physical tokens for all users who

Configuring multi-factor authentication (MFA) enhances authentication strength by verifying user identity, but it does not define what actions a user is authorized to perform (authorization).

DNo action needed. When a Google Cloud organization is created, the appropriate permissions are

Google Cloud organizations do not automatically configure permissions according to least privilege and separation of duties; this requires explicit manual configuration of IAM roles and policies.

Concept tested: IAM least privilege and separation of duties

Source: https://cloud.google.com/iam/docs/overview#least_privilege

Topics

#Google Cloud IAM#Least Privilege#Separation of Duties#Role Management

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice