Examkin

Question

Difficulty: HardConfiguring Organization Policies and Resource Hierarchy Constraints

You are auditing the security configuration of a Google Cloud resource hierarchy. The root Organization node enforces an Organization Policy list constraint (`constraints/compute.trustedImageProjects`) that restricts Compute Engine instance creation to images from `projects/shared-base-images`. A newly created folder named `DataEngineering` requires access to images from `projects/analytics-images` in addition to the globally allowed images. How should you configure the Organization Policy at the `DataEngineering` folder level to satisfy this requirement for all underlying projects?

  1. Configure the policy constraint on the DataEngineering folder, set inheritFromParent to true, and add projects/analytics-images to the allowed values list.Answer
  2. B
    Configure the policy constraint on the DataEngineering folder with inheritFromParent set to false, and add only projects/analytics-images to the allowed values list.
  3. C
    Grant the roles/resourcemanager.organizationAdmin role to engineers on the DataEngineering folder so they can grant IAM permissions to use external disk images.
  4. D
    Assign the roles/owner primitive role at the DataEngineering folder level to automatically bypass all parent Organization Policy constraints for child resources.

Answer

Configure the policy constraint on the DataEngineering folder, set inheritFromParent to true, and add projects/analytics-images to the allowed values list.
For list constraints in Google Cloud Organization Policies, setting `inheritFromParent` to `true` at a child resource level (such as a folder) merges the child's allowed values with the inherited values from higher levels in the resource hierarchy. Adding `projects/analytics-images` alongside `inheritFromParent = true` allows images from both `projects/shared-base-images` (inherited) and `projects/analytics-images` (locally specified).

Step-by-Step Solution

1
Analyze the goal and current hierarchy configuration
The root node permits `projects/shared-base-images`. The `DataEngineering` folder needs to allow both `projects/shared-base-images` and `projects/analytics-images`.
Organization Policy list constraints dictate allowed or denied resource attributes down the hierarchy.
2
Evaluate Organization Policy inheritance rules for list constraints
When `inheritFromParent` is set to `true` on a child node, any additional allowed values specified at the child node are merged with the allowed values inherited from parent nodes.
Setting `inheritFromParent = true` ensures that higher-level organizational baseline constraints remain active while expanding permitted values locally.
3
Select the correct configuration mechanism
Applying the constraint at the `DataEngineering` folder with inheritance enabled and appending `projects/analytics-images` satisfies both global and folder-specific image policies.
This maintains the principle of minimal policy maintenance and compliance enforcement across all nested child projects.

Key Concept

Organization Policy List Constraint Inheritance and Merging
Rate this question

Topics

Configuring Organization Policies and Resource Hierarchy Constraints

More questions from this topic