Examkin

Question

Difficulty: MediumConfiguring Organization Policies and Resource Hierarchy Constraints

An enterprise administrator is configuring governance policies across a Google Cloud resource hierarchy comprising an Organization node, a Development folder, and several child projects. The security policy mandates two constraints:
1. Disable serial port access for Compute Engine virtual machines globally across all projects.
2. Restrict external IP addresses on Compute Engine instances across the organization, except for a specific project named 'dev-bastion-proj' located in the Development folder which requires external network connectivity.

Which two organization policy configurations must the administrator implement to satisfy these requirements? (Select TWO.)

  1. Enforce the boolean constraint constraints/compute.disableSerialPortAccess at the Organization root node.Answer
  2. Configure the list constraint constraints/compute.vmExternalIpAccess to Deny All at the Organization root node, and define an override policy on the dev-bastion-proj project node to allow external IP allocation.Answer
  3. C
    Grant the primitive Owner role to developers on dev-bastion-proj to bypass the organization policy restrictions on external IP addresses.
  4. D
    Enforce constraints/compute.disableSerialPortAccess at the Development folder level only, as child project policies automatically override parent organization restrictions.

Answer

Enforce constraints/compute.disableSerialPortAccess at the Organization root node, and set constraints/compute.vmExternalIpAccess to Deny All at the Organization root with a project-level override on dev-bastion-proj.
Organization policies enforce guardrails across the GCP resource hierarchy. Enforcing constraints/compute.disableSerialPortAccess at the Organization root guarantees global compliance across all child projects. For constraints/compute.vmExternalIpAccess, setting Deny All at the Organization root establishes an enterprise baseline, while configuring an explicit policy override at the dev-bastion-proj project node creates a controlled exception for external networking requirements.

Step-by-Step Solution

1
Identify global restriction requirements
Disabling serial port access globally requires enforcing the boolean constraint constraints/compute.disableSerialPortAccess at the root Organization node so that all folders and projects inherit the restriction.
Organization policies applied at higher hierarchy levels inherit down to all child resources.
2
Configure organization-wide default policy with selective exception
Apply constraints/compute.vmExternalIpAccess with Deny All at the Organization root node to secure all projects by default, then set an explicit policy override on the dev-bastion-proj project node to permit external IPs.
Resource hierarchy inheritance allows lower-level resource nodes (projects) to override list policy constraints inherited from parent nodes when permitted.

Key Concept

Organization Policy Constraints and Resource Hierarchy Inheritance
Rate this question

Topics

Configuring Organization Policies and Resource Hierarchy Constraints

More questions from this topic