GCP Associate Cloud Engineer Practice Question

Your organization has multiple Google Cloud projects managed under personal Gmail accounts. Leadership wants centralized administration that lets IT create and suspend corporate accounts, define groups for IAM policies, and integrate later with on-premises Active Directory. They have no need for Gmail or Google Workspace licences and would like to avoid additional cost. Which Google-provided service best meets these requirements?

Use Cloud IAM to create user principals in each project and add them to custom IAM roles; Cloud IAM is the directory for Google Cloud.
Deploy Cloud Identity-Aware Proxy and configure it to generate Google accounts for employees; IAP provides identity services at no charge.
Create an Organization node in Resource Manager and add users directly to it because the Organization node stores user identities.
Set up a Cloud Identity Free edition tenant and manage users and groups there until integration with Active Directory is configured.

Report Issue

Answer Description

Cloud Identity can be deployed as a standalone directory service, providing lifecycle management for users and groups without requiring paid Google Workspace licenses. A Cloud Identity Free tenant lets administrators create, suspend, or delete user accounts, organize them into groups that can be referenced in IAM bindings, and later synchronize identities from on-premises directories such as Active Directory.

The Organization node is part of the resource hierarchy but is not itself a directory service. Cloud IAM does not host identities-it only authorizes principals that already exist. Cloud Identity-Aware Proxy offers access controls for applications but does not create or manage user accounts.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.