Examkin

Question

Difficulty: HardConfiguring Organization Policies and Resource Hierarchy Constraints

A cloud administration team manages a resource hierarchy where a specific folder named `Analytics-Prod` contains multiple sensitive data processing projects. Security guidelines require that no Compute Engine virtual machine instances within this folder are assigned external IP addresses, and all Cloud Storage buckets created inside this folder must strictly use Uniform Bucket-Level Access. These restrictions must automatically apply to all current and future projects in the `Analytics-Prod` folder, regardless of root-level defaults. Which TWO actions should the administrator take to implement these constraints using Google Cloud Organization Policies?

  1. Apply an Organization Policy at the `Analytics-Prod` folder level for `constraints/compute.vmExternalIpAccess` and set the policy rule to deny all external IPs.Answer
  2. Apply an Organization Policy at the `Analytics-Prod` folder level for `constraints/storage.uniformBucketLevelAccess` and set the boolean constraint to Enforced.Answer
  3. C
    Grant the Storage Admin IAM role (`roles/storage.admin`) at the `Analytics-Prod` folder level to enforce bucket access controls across child projects.
  4. D
    Create an IAM Deny policy at the root Organization level to block inherited network viewing permissions for project owners in the folder.

Answer

The correct actions are applying the `constraints/compute.vmExternalIpAccess` list constraint set to deny all external IPs at the target folder node, and enforcing the `constraints/storage.uniformBucketLevelAccess` boolean constraint at the same target folder node.
To restrict resource capabilities across an entire branch of the resource hierarchy, Organization Policy constraints must be applied at the desired parent folder node. Setting `constraints/compute.vmExternalIpAccess` to deny external IPs and enforcing `constraints/storage.uniformBucketLevelAccess` directly on the target folder ensures compliance across all existing and future child projects via resource hierarchy inheritance.

Step-by-Step Solution

1
Identify the target resource hierarchy node for scope enforcement.
The target scope is the `Analytics-Prod` folder, which allows constraints to propagate down to all contained child projects through inheritance.
Organization policies applied at a folder node automatically inherit down to child projects without impacting unaffected sibling folders.
2
Configure the VM external IP constraint.
The constraint `constraints/compute.vmExternalIpAccess` is configured at the folder level to deny all external IP assignments.
This list constraint blocks external network interfaces on Compute Engine instances within the folder's hierarchy.
3
Configure the storage bucket access constraint.
The boolean constraint `constraints/storage.uniformBucketLevelAccess` is set to Enforced at the folder level.
This forces all newly created and existing Cloud Storage buckets under the folder hierarchy to disable per-object ACLs and enforce uniform bucket-level IAM access.

Key Concept

Organization Policies enforce resource behavior constraints across the GCP resource hierarchy, inheriting down to child folders and projects, distinct from IAM access control permissions.
Estimated Time:2m 0s
Rate this question

Topics

Configuring Organization Policies and Resource Hierarchy Constraints

More questions from this topic