GCP Professional Cloud Security Engineer Practice Question

Your company has 9,000 employees who authenticate to Google Cloud through an on-premises SAML 2.0 identity provider that already enforces multifactor authentication (MFA). In addition, the security team maintains two non-federated "break-glass" super administrator accounts that must never rely on the on-premises IdP. Compliance now requires that all super administrators use only FIDO2 security keys as a second factor, while ordinary users must continue to authenticate via the existing IdP workflow without being challenged twice for MFA. What should you do to meet these requirements with the least disruption?

Generate app passwords for the break-glass accounts, store them in Secret Manager, and configure an Access Transparency alert whenever they are used.
Place the two break-glass super admin accounts in their own organizational unit and enable the Enforce 2-Step Verification policy for that OU, allowing only FIDO2 security keys; keep SAML SSO unchanged for all other users.
Disable SAML SSO for the entire domain and turn on mandatory 2-Step Verification with security keys at the organization level so every user must register a key at next sign-in.
Create a context-aware access level that requires an MFA assertion and apply it to all Google Cloud services; leave 2-Step Verification optional in Google Workspace.

Report Issue

Answer Description

The break-glass super administrator accounts should be isolated from the rest of the workforce and forced to use Google-managed 2-Step Verification (2SV) with FIDO2 security keys. Because the bulk of users are federated, Google Workspace 2SV policies do not affect them-Google redirects them to the SAML IdP, which already requires MFA, so they are not prompted a second time. Moving only the two non-federated accounts into a separate organizational unit or group and applying an "Only security keys" 2SV enforcement policy to that subset meets the compliance mandate without altering the SSO experience for other users. The alternative choices either disrupt all users by disabling SSO, fail to guarantee that only security keys are used, or rely on less secure app passwords that do not provide MFA.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.