Exam Professional Cloud Architect topic 1 question 177 discussion

LOL , if we give this question to someone who know nothing about GCP they will select A

https://cloud.google.com/resource-manager/docs/organization-policy/restricting-domains

Whoever wrote option D was high af.

D is Ridiculous.

Option D is just to create confusion only.

The correct answer is: A. Configure an organization policy to restrict identities by domain. This solution will allow the security team to secure projects that will be part of the Organization by prohibiting IAM users outside the domain from gaining permissions. The other options are not as efficient or effective. Option B would not be efficient, as it would block the creation of all service accounts, which are necessary for some applications. Option C would not be effective, as it would not prevent IAM users from gaining permissions, as it would only remove users that do not belong to the Cloud Identity domain from all projects. Option D would not be efficient, as it would require a Compute Engine instance to be created and a cron job to be configured, which would add complexity and cost to the solution.

A is correct

The security team should configure an organization policy to restrict identities by domain. This will allow them to specify a list of allowed domains, and prevent users from outside those domains from gaining permissions in the Organization. Alternatively, the security team could configure an organization policy to block creation of service accounts. This would prevent the creation of new service accounts, which could be used to grant permissions to users outside the domain. The other options are not recommended. Option C involves manually removing users every hour, which could be time-consuming and error-prone. Option D involves creating a technical user and writing a bash script to delete users, which is not a recommended approach. It would be more secure and efficient to use an organization policy to restrict identities by domain.

A Is the Correct Answer

A is ok

A is the correct answer https://cloud.google.com/resource-manager/docs/organization-policy/restricting-domains

A is right

A is OK

A is ok

2/15/21 exam

must restrict the access, not clean up every hour. see reference from Fotofilico

Go for A