Discuss Google Professional Cloud Security Engineer Exam Topic 1 Question 119

While migrating your organization's infrastructure to GCP, a large number of users will need to access GCP Console. The Identity Management team already has a well-established way to manage your users and want to keep using your existing Active Directory or LDAP server along with the existing SSO password.

What should you do?

AManually synchronize the data in Google domain with your existing Active Directory or LDAP server.

BUse Google Cloud Directory Sync to synchronize the data in Google domain with your existing Active Directory or LDAP server.

CUsers sign in directly to the GCP Console using the credentials from your on-premises Kerberos compliant identity provider.

DUsers sign in using OpenID (OIDC) compatible IdP, receive an authentication token, then use that token to log in to the GCP Console.

Suggested Answer: B

To allow a large number of users to access the GCP Console while keeping the existing Active Directory or LDAP server for identity management, use Google Cloud Directory Sync (GCDS).

Install GCDS:

Download and install Google Cloud Directory Sync from here.

Configure GCDS:

Set up the synchronization by specifying the LDAP server details and the Google domain.

Map the LDAP attributes to Google attributes to ensure user data is synchronized correctly.

Run Synchronization:

Perform an initial synchronization to populate the Google domain with existing users from the LDAP server.

Schedule regular synchronizations to keep the data up-to-date.

Benefits:

Automated Sync: Ensures that user data is consistently updated without manual intervention.

Secure Access: Users can log in to the GCP Console using their existing credentials, enhancing security and user experience.

Google Cloud Directory Sync Documentation

GCDS Administration Guide

Get Premium Professional Cloud Security Engineer Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

15 comments · newest first

Gladis 1 month ago

B keeps everything in sync without manual hassle.

Micheline 1 month ago

Option D sounds interesting too, but I prefer B for stability.

Leonard 1 month ago

C could work, but it might complicate things later.

Billye 2 months ago

But what about option C? Direct sign-in seems simpler.

Rosendo 2 months ago

I agree! Google Cloud Directory Sync is efficient.

Mari 2 months ago

I think option B is the best choice. Easy sync with AD.

Aretha 2 months ago

Wait, can we really use our old Kerberos setup for GCP?

Carolynn 2 months ago

I agree with B, saves a lot of headaches!

Willard 2 months ago

C sounds interesting, but is it really secure enough?

Twanna 3 months ago

I think A is too much manual work, not efficient.

Brande 3 months ago

B is the way to go, super easy sync!

Yvonne 3 months ago

I recall that using an OIDC compatible IdP could simplify the login process, but I’m not sure if it’s the best choice for our existing setup.

Rosalind 3 months ago

I’m a bit confused about the Kerberos option. I know it’s secure, but does it really integrate well with GCP?

Pete 3 months ago

I think Google Cloud Directory Sync sounds familiar from our practice questions. It might be the most efficient option for keeping everything in sync.

Emogene 4 months ago

I remember discussing the importance of synchronizing user data, but I'm not sure if manual synchronization is the best approach.

Google Professional Cloud Security Engineer Exam - Topic 1 Question 119 Discussion