PCSE Practice Question: Configuring Access Within a Cloud Solution Environment
An organization uses Cloud Identity with a third-party IdP via SAML 2.0. A security engineer needs to enforce that all Google Cloud access requires multi-factor authentication (MFA) from the IdP. What is the recommended approach?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Require MFA in the third-party IdP before it issues SAML assertions.
The best practice is to configure MFA at the IdP level because the IdP is the authoritative source for authentication. This ensures MFA is enforced before SAML assertion is issued, and it works for all applications relying on that IdP, including Google Cloud. Enforcing MFA on Google Cloud side via IAP or context-aware access is possible but not the recommended primary enforcement for SAML federated users; it should be done at the IdP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an organization policy constraint requiring the use of security keys for all users.
Why it's wrong here
Organization policies cannot enforce MFA; they enforce resource-level constraints.
- ✓
Require MFA in the third-party IdP before it issues SAML assertions.
Why this is correct
This is the recommended approach: enforce MFA at the IdP so that only authenticated users with MFA can access Google Cloud resources.
- ✗
Enable MFA enforcement in the Cloud Identity admin console for all users.
Why it's wrong here
Cloud Identity MFA is for Google-managed accounts, not for federated users authenticated via SAML.
- ✗
Configure a context-aware access level in Access Context Manager that requires MFA, and apply it to Google Cloud resources.
Why it's wrong here
This enforces MFA on Google side, but for federated users, MFA is ideally enforced at the IdP to avoid a separate challenge.
Go deeper
Related to this question
About these practice questions
One of 960 original PCSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.