Examkin

Question

Difficulty: Very hardConfiguring Organization Policies and Resource Hierarchy Constraints

An enterprise organization maintains a Google Cloud resource hierarchy containing an Organization root node, a Production Folder, and several workload projects. An Organization Policy enforcing the `constraints/compute.vmExternalIpAccess` constraint with a policy rule set to `Deny All` is applied at the Organization root. A security administrator must enable virtual machines in one specific project (`Project-Web`), located under the Production Folder, to be assigned external IP addresses, while ensuring that all other existing and future projects in the hierarchy remain restricted from allocating external IPs. Which TWO statements correctly describe how Organization Policies and IAM permissions must be configured to achieve this architecture?

  1. An explicit Organization Policy must be applied directly at the `Project-Web` level to override the inherited parent constraint, setting rules to allow external IP allocation for that specific project.Answer
  2. Users or service accounts provisioning VM instances in `Project-Web` still require appropriate IAM roles (such as Compute Admin) because Organization Policies define guardrails rather than granting operational access permissions.Answer
  3. C
    Granting the Organization Policy Admin role (`roles/orgpolicy.policyAdmin`) to project developers automatically bypasses the active Organization Policy restrictions inherited from the Organization root.
  4. D
    The `constraints/compute.vmExternalIpAccess` constraint at the Organization root level must be completely removed because child projects cannot override policies inherited from parent folders or root nodes.
  5. E
    Assigning the primitive `Owner` IAM role at the `Production Folder` level automatically grants child projects an exemption from Organization Policy list constraints.

Answer

To allow external IP assignment on virtual machines in a single project while keeping all other projects restricted, an administrator must override the inherited constraint by configuring a policy directly at the target project level, and ensure principals possess requisite IAM roles since Organization Policies establish constraints rather than grant permissions.
The correct statements correctly identify the mechanism of policy inheritance and the distinction between IAM and Organization Policies. Child resource nodes (like specific projects) can explicitly override inherited parent list constraints to grant localized exemptions. Furthermore, Organization Policies set system boundaries and do not replace IAM roles, so users must still be granted proper IAM permissions to create resources.

Step-by-Step Solution

1
Analyze resource hierarchy evaluation for Organization Policies.
Realize that Organization Policies inherit downward from Organization Root down through Folders to Projects.
By default, child resources inherit parent restrictions unless a specific policy rule is applied at the child level to override the inherited parent configuration.
2
Configure the project-level Organization Policy override.
Apply an explicit policy at the target project level for the external IP constraint to allow allocations for that project only.
Overriding the policy at the target project scope selectively opens external IP provisioning for that project while leaving the root constraint enforcing restriction across all other projects under the folder and root.
3
Evaluate the relationship between Organization Policies and IAM roles.
Verify that deployment principals hold appropriate Compute Engine IAM permissions.
Organization Policies function as declarative guardrails restricting resource configurations; they do not grant identity permissions to execute GCP API calls.

Key Concept

Organization Policy Hierarchy Inheritance and IAM Separation of Concerns
Rate this question

Topics

Configuring Organization Policies and Resource Hierarchy Constraints

More questions from this topic