PCSE Practice Question: Configuring Access Within a Cloud Solution Environment
An organization uses Active Directory (AD) on-premises and wants to synchronize user accounts and groups to Google Cloud Identity for SSO with SAML 2.0. The AD contains 50,000 users and 10,000 groups. The solution must support automatic provisioning and deprovisioning of users. Which tool should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Google Cloud Directory Sync (GCDS) to synchronize users and groups from AD to Cloud Identity.
Google Cloud Directory Sync (GCDS) is the official tool for synchronizing users and groups from Active Directory (or LDAP) to Google Cloud Directory. It supports one-way sync, automatic provisioning, and deprovisioning. SAML SSO is configured separately using an IdP like Active Directory Federation Services (AD FS) or third-party. Workload Identity Federation is for external workloads (e.g., AWS, Azure) to access GCP resources, not for user identity synchronization. Cloud Identity API can be used programmatically but is not a ready-to-use sync tool. GCDS is the correct answer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use SAML 2.0 federation with AD FS to synchronize users.
Why it's wrong here
SAML 2.0 provides SSO, not user synchronization. It does not automatically provision users in Google Cloud Directory.
- ✗
Use Workload Identity Federation to connect AD to Google Cloud.
Why it's wrong here
Workload Identity Federation is for granting external workloads (e.g., AWS, Azure, GitHub Actions) access to GCP, not for synchronizing user identities from AD.
- ✗
Use the Cloud Identity API to manually create users and groups.
Why it's wrong here
Manual creation is not scalable for 50,000 users and does not provide automatic provisioning/deprovisioning.
- ✓
Use Google Cloud Directory Sync (GCDS) to synchronize users and groups from AD to Cloud Identity.
Why this is correct
GCDS is designed for this exact purpose: one-way sync from AD/LDAP to Google Cloud Directory, including automatic provisioning and deprovisioning.
Go deeper
Related to this question
About these practice questions
This PCSE question is part of Courseiva's 960-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.