How to Retroactively Enforce Strong Password Policies in Cloud Identity
You work for a large organization that is using Cloud Identity as the identity provider (IdP) on Google Cloud. Your InfoSec team has mandated the enforcement of a strong password with a length between 12 and 16 characters for all users. After configuring this requirement, users are still able to access the Google Cloud console with passwords that are less than 12 characters. You need to fix this problem within the Admin console. What should you do?
Community Votes
75% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Tests understanding of how Google Cloud Identity handles policy changes versus existing credentials, with the common trap being assuming new settings apply instantly without a forced refresh.
This question tests retroactive enforcement of Cloud Identity password policies. The page establishes that enabling the "Enforce password policy at next sign-in" setting is required to force existing non-compliant users to update their credentials.
Users often choose D, assuming they just need to toggle "Enforce strong password," but fail to realize the policy was already configured and requires a specific enforcement trigger for legacy passwords.
Community Discussion (5 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Cloud Identity evaluates password strength only during initial creation or subsequent changes. When an administrator updates the organizational baseline to require 12–16 characters, existing compliant and non-compliant credentials remain active until explicitly overridden. Selecting the organization-level enforcement toggle instructs the directory to validate current hashes against the new threshold and redirect affected users to a mandatory reset screen during their next authentication attempt. This centralized mechanism guarantees immediate compliance without manual intervention.Why the Other Options Are Wrong
Manually reviewing and resetting individual user passwords introduces unnecessary operational overhead and creates audit inconsistencies across large enterprises. Toggling the strong password requirement again serves no purpose since the policy threshold was already successfully configured in the previous step. Per-account adjustments also bypass the intended administrative workflow, violating scalability principles tested throughout the certification.Community Comment Notes
Learners frequently debate whether to re-enable the strong password feature or trigger the retroactive enforcement switch. As dat987 confirmed, the official administration guide explicitly recommends the next sign-in enforcement path for this exact scenario. Several other contributors initially favored re-toggling the policy but later acknowledged that the existing configuration only requires a propagation command rather than a duplicate setup. The voting trend ultimately converged on the correct administrative action once the distinction between policy definition and policy application became clear.Official Reference
Exam Strategy
Always distinguish between configuring a new security baseline and enforcing it retroactively across an existing user base. For Google Cloud identity questions, look for settings that explicitly mention "next sign-in" or "force change" when legacy credentials bypass new rules.
Frequently Asked Questions
Why doesn't the strong password policy apply immediately to existing users?
Cloud Identity only validates the policy during password creation or change. Legacy passwords remain valid until the administrator explicitly forces a retroactive update via the next sign-in enforcement toggle.
Can I manually reset every user's password instead?
No, resetting passwords individually is inefficient and breaks audit trails. The Admin console provides a centralized enforcement switch designed exactly for this scenario.