Google Cloud Certified Identity and Access Management 3

Question 1

A company uses on-premises Active Directory for user management. They want GCP console access for employees without creating separate Cloud Identity accounts. What should they use?

Accepted Answer

Google Cloud Directory Sync (GCDS) with SAML-based SSO via their IdP

Answer

OAuth 2.0 direct integration

Answer

Cloud Identity with manual user sync

Answer

Workload Identity Federation

Question 2

Which IAM role should be assigned to a CI/CD pipeline service account that needs to deploy Kubernetes workloads to GKE but should not have cluster admin access?

Accepted Answer

roles/container.developer

Answer

roles/container.admin

Answer

roles/container.clusterAdmin

Answer

roles/editor

Question 3

What is an IAM deny policy in Google Cloud?

Accepted Answer

A policy that explicitly denies specific permissions to specific principals, overriding allow policies

Answer

A policy that blocks all access to a project for non-admin users

Answer

A policy that denies access during specified time windows

Answer

A policy that prevents IAM changes by non-owner accounts

Question 4

A Cloud Architect needs to audit all IAM policy changes in a GCP organization over the past 30 days. Which service provides this data?

Accepted Answer

Cloud Audit Logs (Admin Activity logs)

Answer

Cloud Monitoring

Answer

Cloud Trace

Answer

Error Reporting

Question 5

Which feature allows you to grant a user temporary, time-limited elevated access in Google Cloud without permanently modifying IAM policies?

Accepted Answer

Privileged Access Manager (PAM)

Answer

IAM Deny Policies

Answer

IAM Conditions with date/time expressions

Answer

VPC Service Controls sessions

Question 6

When a GCP IAM policy is set at a folder level and another policy exists at the project level within that folder, how are the policies combined?

Accepted Answer

The union of both policies applies (policies are inherited and additive)

Answer

The project-level policy overrides the folder-level policy

Answer

The folder-level policy overrides the project-level policy

Answer

An error occurs due to policy conflict

Question 7

A startup wants to allow a BigQuery analyst contractor access to run queries on production data for exactly two weeks. What is the BEST way to implement this with IAM?

Accepted Answer

Use IAM Conditions to add a date/time expiry condition on the role binding

Answer

Grant them roles/bigquery.dataViewer and roles/bigquery.jobUser permanently, then revoke manually after two weeks

Answer

Create a temporary project and move the data there

Answer

Use a shared service account with the analyst