In policy terms, which constraint explains why an external identity with project-level access cannot access SecOps?

• A. External users must be synced via GCDS.
• B. SecOps blocks sign-ins from identities outside the primary domain.
• C. constraints/iam.allowedPolicyMemberDomains restricts IAM role assignments to identities within your company domain only.
• D. roles/chronicle.viewer doesn't apply to external identities.

Answer: (C)

In policy terms, access is controlled by who is allowed to be a member of a resource’s IAM bindings. The constraint constraints/iam.allowedPolicyMemberDomains enforces that only identities from approved domains can be granted roles in a policy. If SecOps is configured so that its IAM bindings only allow members from your company domain, an external identity—no matter what project-level access they have—cannot be added to the SecOps policy. Without being a permitted domain member, they can’t obtain the SecOps role and therefore can’t access SecOps.

Other options miss the policy-only angle: syncing external users via GCDS relates to directory replication, blocking sign-ins from outside the primary domain is an authentication control rather than a policy membership restriction, and the Chronicle viewer role doesn’t address the domain-based eligibility constraint for policy bindings.