Examkin

Question

Difficulty: EasyConfiguring Organization Policies and Resource Hierarchy Constraints

A security operations team wants to ensure that no virtual machines created within a development Folder can be assigned public IP addresses. This rule must automatically apply to all current and future projects inside that folder. Which configuration should be used to enforce this restriction?

  1. Apply an Organization Policy constraint at the Folder level to restrict public IP addresses.Answer
  2. B
    Assign a predefined IAM Security Reviewer role to developers at the Folder level.
  3. C
    Revoke primitive Viewer permissions from developers across all child projects.
  4. D
    Add an IAM Deny policy on individual child projects to override resource permissions inherited from the Folder.

Answer

Apply an Organization Policy constraint at the Folder level to restrict public IP addresses.
Organization Policies provide centralized, programmatic control over cloud resources. Applying an Organization Policy constraint at the Folder level automatically applies the restriction to all existing and newly created child projects within that folder.

Step-by-Step Solution

1
Identify the requirement scope and goal.
The requirement asks to restrict a specific resource configuration (external IPs on VMs) centrally at a Folder node so that all child projects inherit the restriction.
Centralized resource restrictions across a hierarchy subtree require resource constraints rather than user access management.
2
Evaluate Google Cloud mechanisms for resource configuration enforcement.
Organization Policies are designed to enforce constraints on GCP resources across the resource hierarchy (Organization, Folder, Project).
Setting the constraint at the Folder level ensures all current and future child projects in that folder inherit the policy automatically.

Key Concept

Organization Policy Constraints and Resource Hierarchy Inheritance
Estimated Time:45s
Rate this question

Topics

Configuring Organization Policies and Resource Hierarchy Constraints

More questions from this topic