Examkin

Question

Difficulty: MediumConfiguring Organization Policies and Resource Hierarchy Constraints

A security specialist needs to mandate that no user or service account can generate long-lived service account keys across any existing or future projects located inside the `Staging-Services` folder. This security requirement must be automatically inherited across all child resources without restricting developers from performing standard resource management tasks within their projects. Which solution enforces this operational restriction?

  1. Apply an Organization Policy enforcing the `constraints/iam.disableServiceAccountKeyCreation` boolean constraint at the `Staging-Services` folder node.Answer
  2. B
    Revoke the `roles/iam.serviceAccountKeyAdmin` IAM role at the Organization root and assign the primitive `Viewer` role to developers on the `Staging-Services` folder.
  3. C
    Configure an IAM policy at each individual project level that grants developers `roles/owner` while revoking key creation permissions at the folder level.
  4. D
    Assign developers the `roles/resourcemanager.organizationAdmin` role on the `Staging-Services` folder so they can self-police key creation.

Answer

The requirement is met by applying an Organization Policy enforcing the `constraints/iam.disableServiceAccountKeyCreation` boolean constraint at the `Staging-Services` folder node.
Organization Policies are designed to set programmatic constraints on specific GCP resources across an Organization, Folder, or Project. By enforcing `constraints/iam.disableServiceAccountKeyCreation` at the `Staging-Services` folder level, all current and future projects inside that folder automatically inherit the restriction, preventing any user or service account from creating long-lived service account keys while retaining their standard IAM permissions for other tasks.

Step-by-Step Solution

1
Identify the governance mechanism required to enforce programmatic restrictions across a group of projects.
Recognize that Organization Policies (not IAM roles) define constraints on GCP resource configurations across the resource hierarchy.
IAM controls who (identity) has permissions to act on resources, whereas Organization Policies control what (resource constraints) can be done on resources regardless of user identity.
2
Determine the appropriate placement node in the GCP resource hierarchy.
Select the `Staging-Services` folder node.
Applying the constraint at the folder level ensures that all existing and future child projects under that folder automatically inherit the enforcement policy.
3
Select the exact Organization Policy constraint matching the operational security requirement.
Enforce `constraints/iam.disableServiceAccountKeyCreation`.
This specific boolean constraint disables the creation of external service account credentials (service account keys) for all projects within the targeted hierarchy scope.

Key Concept

Organization Policies govern resource configuration constraints across the GCP resource hierarchy via inheritance, distinct from IAM access controls.
Estimated Time:1m 30s
Rate this question

Topics

Configuring Organization Policies and Resource Hierarchy Constraints

More questions from this topic