Professional Cloud Security EngineerConfiguring access within a cloud solution environmentHard
A large enterprise uses Google Cloud and has implemented a strict security policy requiring all access to production environments to be reviewed and approved by a security team member before being granted. This includes access by Google Support personnel during troubleshooting. How can this requirement be met for Google Cloud resources?
- AImplement IAM Conditions to require multi-factor authentication for all production resource access.
- BUse Cloud Audit Logs to monitor all access attempts and manually block unauthorized access.
- CConfigure Google Cloud Access Approval for the relevant projects or folders.
- DCreate a custom IAM role that only allows security team members to grant access to production resources.
Show answer & explanationAnswer & explanation
Correct answer: C. Configure Google Cloud Access Approval for the relevant projects or folders.
Google Cloud Access Approval is specifically designed to allow customers to approve or deny access requests by Google support and engineering personnel to their data and resources. This directly addresses the requirement for pre-approval by a security team.
Why the other options are wrong
- A. IAM Conditions enforce access policies but do not provide a mechanism for explicit human approval of Google personnel access.
- B. Monitoring audit logs is reactive and does not provide a preventative approval workflow for Google personnel access.
- D. While custom roles manage internal user access, they do not control access by Google support personnel, which is the specific focus of this question's requirement.
Google Cloud Access Approval
Google Cloud Access Approval allows customers to explicitly approve or deny requests by Google support and engineering personnel to access customer data or configurations for diagnostic or troubleshooting purposes.
- Provides transparency and control over Google's internal access.
- Integrates with existing approval workflows.
- Generates audit logs for all access requests and approvals/denials.
- Helps meet compliance requirements for data access controls.
Memory trick: Google's knocking? Access Approval must give the OK!