Google Cloud Professional Cloud Security Engineer — Question 95

You work for a large organization where each business unit has thousands of users. You need to delegate management of access control permissions to each business unit. You have the following requirements:
✑ Each business unit manages access controls for their own projects.
✑ Each business unit manages access control permissions at scale.
✑ Business units cannot access other business units' projects.
✑ Users lose their access if they move to a different business unit or leave the company.
✑ Users and access control permissions are managed by the on-premises directory service.
What should you do? (Choose two.)

Answer options

• A. Use VPC Service Controls to create perimeters around each business unit's project.
• B. Organize projects in folders, and assign permissions to Google groups at the folder level.
• C. Group business units based on Organization Units (OUs) and manage permissions based on OUs
• D. Create a project naming convention, and use Google's IAM Conditions to manage access based on the prefix of project names.
• E. Use Google Cloud Directory Sync to synchronize users and group memberships in Cloud Identity.

Correct answer: B, E

Explanation

The correct answer is B and E. Organizing projects in folders and assigning permissions to Google groups at the folder level allows each business unit to manage their access effectively while keeping projects isolated. Using Google Cloud Directory Sync ensures that user access reflects changes in their status within the organization, maintaining the integrity of permissions. Options A, C, and D do not adequately address the requirements for access management and isolation between business units.