Cloud Digital Leader Google Cloud Security Practice Question
A large enterprise wants to enforce the principle of least privilege for its cloud resources. The security team needs to audit all IAM policy changes across the organization and ensure that custom roles are used where predefined roles are too permissive. Which three Google Cloud services or features should be combined to achieve this? (Choose three.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
IAM Recommender
Cloud Audit Logs track IAM policy changes. Organization policies can enforce constraints like restricting the use of predefined roles. IAM Recommender provides recommendations to reduce permissions. Cloud Asset Inventory can also be used for IAM policy auditing. Security Command Center is for threat detection, not IAM auditing. Policy Analyzer helps understand access, but the combination of Audit Logs, Organization Policies, and IAM Recommender is most direct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
IAM Recommender
Why this is correct
IAM Recommender leverages Google Cloud's usage data and machine learning to analyze each principal's actual permissions usage over the past 90 days, then generates role recommendations that remove unnecessary permissions and flags over-privileged accounts. It surfaces findings like role churn or unused roles, and supports applying the suggested least-privilege bindings directly or via Terraform, enabling continuous, data-driven remediation of excessive IAM permissions without disrupting existing workflows.
- ✗
Cloud Key Management Service
Why it's wrong here
Cloud Key Management Service (Cloud KMS) is fundamentally a cryptographic key management system that lets you create, import, rotate, and destroy symmetric and asymmetric encryption keys used to protect data at rest and in transit. It does not analyze IAM policies, recommend role adjustments, or enforce least-privilege access; instead, it provides key material and operations on that material, with IAM often used to control access to the keys themselves, not to assess or optimize user roles across the organization.
- ✓
Cloud Audit Logs
Why this is correct
Cloud Audit Logs records each IAM policy change as an Admin Activity audit log entry, capturing who made the change, what change was made, and when it occurred, which is essential for compliance, forensic analysis, and post-incident review. However, these logs are a passive record of historical events; they do not analyze existing roles for over-privilege, generate least-privilege recommendations, or actively suggest role modifications, so they support auditing governance but not proactive IAM optimization.
- ✓
Organization Policies
Why this is correct
Organization Policies allow you to set constraints on Cloud Resource Manager nodes, for example using the `iam.automaticIamGrantsForDefaultServiceAccounts` constraint or custom constraints to restrict role assignments, such as requiring that only custom roles with precisely defined permissions are used instead of broader predefined roles. While this can indirectly enforce least privilege by limiting what is available, it does not inspect current usage or recommend specific role adjustments; it is a guardrail that prevents certain configurations rather than an analyzer that identifies and suggests least-privilege roles for existing principals.
- ✗
Security Command Center
Why it's wrong here
Security Command Center (SCC) is a security and risk management platform that aggregates findings from services like Web Security Scanner and Cloud Armor, detects vulnerabilities such as open firewall ports or misconfigured network settings, and provides threat detection through Event Threat Detection and Continuous Monitoring with Security Health Analytics. Although SCC includes IAM-related findings like 'Role was granted to a user' or 'Policy in violation', it does not perform usage-based IAM role optimization, nor does it recommend specific least-privilege roles; its focus is on discovering active threats and compliance issues, not on proactive IAM policy refinement based on permission usage.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
Key term
Security Command Center
Security Command Center is a centralized cloud security management platform that helps organizations detect, investigate, and respond to threats across their cloud infrastructure.
About these practice questions
One of 829 original GCDL practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.