PCSE Practice Question: Configuring Access Within a Cloud Solution Environment
An engineer needs to grant a group of external auditors read-only access to all resources in a specific project. The auditors authenticate via an external SAML 2.0 IdP. What is the most secure and efficient way to set this up?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Cloud Directory Sync to sync the auditors from the external IdP as Google Groups, then grant the group Viewer role.
The correct approach is to create a Google Group and configure SAML SSO for Cloud Identity. Then, grant the Google Group the 'Viewer' role at the project level. The auditors authenticate via SAML and become members of the group, inheriting the permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create individual Google accounts for each auditor and assign them the Viewer role.
Why it's wrong here
Managing individual accounts is less efficient and secure than using groups.
- ✗
Configure IAP with the external IdP and grant access to the project's resources through IAP.
Why it's wrong here
IAP is for applications, not for direct project-level IAM access.
- ✓
Use Cloud Directory Sync to sync the auditors from the external IdP as Google Groups, then grant the group Viewer role.
Why this is correct
Cloud Directory Sync can synchronize groups from the IdP. Granting the group the Viewer role is efficient and maintains group membership in the IdP.
- ✗
Create a custom role with read-only permissions and assign it to each auditor individually.
Why it's wrong here
Individual assignment is not efficient; group-based assignment is better.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCSE question from scratch — 960 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.