Examkin

Question

Difficulty: MediumConfiguring Organization Policies and Resource Hierarchy Constraints

A cloud administrator manages resource constraints across an enterprise Google Cloud hierarchy. An Organization Policy using the Boolean constraint constraints/compute.vmCanIpForward is set to Enforced at the Analytics folder level to prevent virtual machines from enabling IP forwarding. A specific workload inside this folder, located in the Network-Appliance project, requires a virtual machine to act as a router with IP forwarding enabled. How should the administrator configure the environment to allow IP forwarding specifically for the Network-Appliance project while maintaining the constraint for all other projects in the folder?

  1. Override the inherited policy by configuring the constraints/compute.vmCanIpForward constraint to Enforced: Off specifically at the Network-Appliance project level.Answer
  2. B
    Grant the Compute Admin (roles/compute.admin) IAM role to the service account in the Network-Appliance project so it can bypass the folder Organization Policy.
  3. C
    Assign the primitive Owner role on the Network-Appliance project to override inherited folder constraints.
  4. D
    Create an IAM Deny policy at the Analytics folder level blocking compute.instances.create and add an IAM policy binding exception for the Network-Appliance project.

Answer

Override the inherited policy by setting the constraints/compute.vmCanIpForward Organization Policy constraint to Enforced: Off explicitly at the Network-Appliance project level.
Google Cloud Organization Policies evaluate constraints hierarchically. When a parent folder enforces a Boolean constraint such as disabling IP forwarding, all descendant projects inherit that restriction. To create an exception for a single project, an administrator configures an explicit Organization Policy on that project with the Boolean constraint enforcement set to Off (unenforced), which overrides the inherited policy for that project only.

Step-by-Step Solution

1
Analyze how Organization Policies inherit down the Google Cloud resource hierarchy.
Policies applied at a parent node (Folder) automatically apply to all child nodes (Projects) unless an explicit policy override is configured at the child level.
Hierarchical inheritance ensures consistent guardrails across sub-resources.
2
Determine the mechanism required to disable a Boolean Organization Policy constraint for a specific sub-resource.
Setting the Boolean constraint enforcement status to Off (false) on the specific target project overrides the inherited Enforced status from the parent folder.
Explicit child node settings take precedence over inherited parent node policies.

Key Concept

Organization Policy Boolean Constraint Inheritance and Explicit Overrides
Estimated Time:1m 30s
Rate this question

Topics

Configuring Organization Policies and Resource Hierarchy Constraints

More questions from this topic