1Configuring access

• 1.1Cloud Identity, service accounts, and authentication

  Understand Cloud Identity management (Google Cloud Directory Sync, SSO with third-party IdPs, super admin, user-lifecycle automation, Workforce Identity Federation), securing service accounts (default SAs, key auditing/mitigation, short-lived credentials, Workload Identity Federation, impersonation), and authentication (password/session policy, SAML/OAuth, 2-step verification).

• 1.2Authorization controls and resource hierarchy

  Understand IAM privileged roles and separation of duties, IAM/ACL permissions, IAM conditions and IAM deny policies, least privilege at organization/folder/project/resource, Access Context Manager, Policy Intelligence, permissions via groups, Privileged Access Manager, and the resource hierarchy (managing folders/projects at scale, pre-built/custom org policies, inheritance).