Integrating On-Premises Active Directory with Google Cloud IAM

The question asks for the two steps to integrate on-premises Active Directory (AD) with Google Cloud and configure access management. This involves two distinct phases: identity synchronization and authorization configuration.

First, to make AD users and groups available in Google Cloud, you must synchronize them. Google Cloud Directory Sync (GCDS) is the standard tool for this purpose, allowing administrators to sync user and group data from an on-premises AD to Cloud Identity. Without this step, the identities do not exist in the Google Cloud environment to be granted permissions. Therefore, installing GCDS is a necessary prerequisite.

Second, once the groups are synced, you need to grant them access. In Google Cloud, permissions are assigned via IAM Roles. You assign these roles to specific groups (which were synced from AD). Option D correctly describes creating IAM roles with permissions corresponding to each AD group. Note that while you assign roles to groups, you don't necessarily "create" new IAM groups if the synced AD groups suffice, but you do define the IAM policies/roles binding those groups to resources.

Let's evaluate the distractors:

• A: Identity Platform is for custom app authentication, not enterprise AD integration.
• B: SAML integration handles authentication (SSO), but it does not sync user/group objects or handle authorization/access management directly. The question asks for both integration AND access management.
• E: Creating IAM groups is redundant if GCDS is syncing AD groups. Furthermore, IAM itself doesn't have "groups" in the same way; it uses resource hierarchy and policy bindings. The term "IAM groups" is often confused with Cloud Identity groups. Even if interpreted as Cloud Identity groups, GCDS handles the creation/syncing, so manually creating them contradicts the sync process. More importantly, option D focuses on the permission assignment (Roles), which is the core of "access management".

Comparing C/D vs C/E: Commenters debate whether to create IAM groups or roles. Google's architecture emphasizes syncing AD groups via GCDS and then assigning IAM Roles to those groups. Option D explicitly mentions creating IAM roles corresponding to AD groups, which is the correct mechanism for defining access. Option E suggests creating IAM groups, which is less precise terminology and potentially redundant with the sync. The most robust answer pair is synchronizing the identity (C) and defining the access controls via roles (D). However, many exam guides and community votes favor C and E, interpreting "IAM groups" loosely as the target for role assignment. Let's look closer at official documentation. GCDS syncs to Cloud Identity. Access is managed by binding IAM Roles to members (users/groups). Option D says "Create IAM roles... corresponding to each AD group". This implies defining the permission set. Option E says "Create IAM groups... corresponding to each AD group". Since GCDS syncs the groups, you don't create them in GCP manually. You assign roles TO them. Therefore, D is technically more accurate regarding the "Access Management" part (defining the Role). However, some interpretations might view "creating IAM groups" as setting up the structure. Let's re-read carefully. "Configure access management". If I use GCDS, the groups exist. I then need to give them permissions. I do this by creating/updating IAM Policies that bind Roles to those Groups. Option D says "Create IAM roles...". You create Roles once and bind them. Option E says "Create IAM groups...". You don't create them; they are synced. Thus, D is logically superior to E for the second step. Wait, looking at common PCSE questions, the "trick" is often that GCDS syncs the accounts, and then you map them. Is there a better option? B is only auth. A is wrong. So it's between CD and CE. Given GCDS syncs groups, creating IAM groups (E) is redundant/wrong. Creating IAM roles (D) is part of the setup. Therefore, C and D is the strongest technical fit.

However, let's consider the source answer key usually provided in such dumps. Often, these exams conflate terms. But strictly speaking, GCDS + IAM Roles is the correct pattern. Let's check if "IAM Groups" is a valid concept in the context of the exam. In Google Cloud, you attach policies to groups. These groups come from Cloud Identity. If GCDS syncs them, they are there. You don't create them. So E is incorrect. D is correct because you define the roles that grant the permissions.

Therefore, the correct steps are: Install GCDS (C) and Create IAM Roles corresponding to the AD groups (D).