Google Updated Professional-Cloud-Security-Engineer Exam Questions and Answers by blake

To delegate management of access control permissions to each business unit effectively, organizing projects into folders and assigning permissions to Google groups at the folder level allows for scalable and manageable access control. Using Google Cloud Directory Sync (GCDS) to synchronize users and groups from the on-premises directory service ensures that access controls are maintained and updated automatically as users change roles or leave the company.

Steps:

Organize Projects in Folders: Create a folder structure in the Google Cloud Resource Manager to organize projects by business unit.

Assign Permissions to Google Groups: Use IAM to assign necessary permissions to Google Groups at the folder level, ensuring each business unit can manage access controls for their own projects.

Synchronize Users and Groups: Use GCDS to sync users and group memberships from your on-premises directory service to Google Cloud Identity, ensuring that changes in the on-premises directory are reflected in Google Cloud.

References:

Google Cloud Resource Manager

Google Cloud Directory Sync

To meet the requirements of encrypted communication over private IP addresses between Compute Engine instances in different Google Cloud organizations, a Cloud VPN connection is appropriate:

Cloud VPN: Cloud VPN creates a secure, encrypted tunnel between your organization's VPC network and the third party's VPC network. This ensures that data transmitted over the network is encrypted and secure.

Private IP Communication: Cloud VPN allows communication over private IP addresses, which helps maintain security by keeping traffic within the Google Cloud network and not exposing it to the public internet.

Firewall Rules: VPC firewall rules can be configured to control the traffic that flows through the VPN, ensuring that only authorized traffic is allowed, further enhancing security.

By setting up a Cloud VPN connection, you can achieve secure, encrypted communication over private IP addresses between different Google Cloud organizations.

References

Cloud VPN Overview

Objective: Prevent users from creating projects while allowing only the DevOps team to create projects.

Solution: Modify IAM roles and permissions.

Steps:

Step 1: Open the Google Cloud Console.

Step 2: Navigate to the IAM & Admin page.

Step 3: At the organizational level, find and remove all users from the Project Creator role.

Step 4: Create or identify a group for the DevOps team.

Step 5: Assign the Project Creator role to the DevOps team group at the organizational level.

By removing all users from the Project Creator role and granting it only to the DevOps team, you ensure that only the designated team can create projects.

References:

GCP IAM Documentation

Project Creator Role

https://cloud.google.com/logging/docs/access-control#considerations roles/logging.privateLogViewer (Private Logs Viewer) includes all the permissions contained by roles/logging.viewer, plus the ability to read Data Access audit logs in the _Default bucket.