PCSE Practice Question: Configuring Access Within a Cloud Solution Environment
A company uses Google Cloud Directory Sync (GCDS) to synchronize users from an on-premises Active Directory to Cloud Identity. The security team wants to ensure that only synchronized users can access Google Cloud resources. Which TWO actions are part of a secure configuration? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disable manual user creation in the Cloud Identity admin console.
Correct actions: 1) Disable the creation of manual users in Cloud Identity to ensure all users come from AD only. 2) Restrict the allowed domains for IAM members to the company's domain (e.g., example.com) using Organization Policy constraint 'constraints/iam.allowedPolicyMemberDomains' to prevent external users from being added. Enabling automatic license assignment is not a security measure. Using the default admin account is not recommended. Syncing passwords is not recommended; GCDS does not sync passwords.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable automatic license assignment for all synchronized users.
Why it's wrong here
License assignment is about assigning services, not about access control.
- ✗
Configure GCDS to sync user passwords.
Why it's wrong here
GCDS does not sync passwords; it only syncs identity attributes.
- ✗
Create a custom role that allows only synchronized users to access resources.
Why it's wrong here
Custom roles cannot distinguish synchronized users from manual users; they are identity-based.
- ✓
Disable manual user creation in the Cloud Identity admin console.
Why this is correct
This ensures that only synchronized users exist, preventing rogue manual accounts.
- ✓
Use the Organization Policy constraint constraints/iam.allowedPolicyMemberDomains to restrict IAM members to the company's domain.
Why this is correct
This prevents users from other domains from being assigned roles in IAM.
Go deeper
Related to this question
About these practice questions
This PCSE question is part of Courseiva's 960-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.