Examkin

Question

Difficulty: HardConfiguring Organization Policies and Resource Hierarchy Constraints

An enterprise Google Cloud organization enforces a list constraint at the root organization node using `constraints/compute.trustedImageProjects`, which explicitly allows images only from `projects/corp-base-images`. A cloud team managing a folder named `DataOps` needs to deploy Virtual Machine instances using custom images from `projects/dataops-custom-images`. However, instances in `DataOps` must also remain capable of using images from `projects/corp-base-images`. Which policy configuration on the `DataOps` folder will fulfill these security requirements?

  1. Enforce `constraints/compute.trustedImageProjects` on the `DataOps` folder, set the allowed values to include `projects/dataops-custom-images`, and retain policy inheritance from the parent node.Answer
  2. B
    Grant the Compute Admin (`roles/compute.admin`) IAM role to the deployment service account at the `DataOps` folder level to bypass organization policy restrictions.
  3. C
    Enforce `constraints/compute.trustedImageProjects` on the `DataOps` folder, set the rule to replace the parent policy, and list only `projects/dataops-custom-images`.
  4. D
    Assign the primitive Owner (`roles/owner`) role on target projects inside the `DataOps` folder to grant an explicit policy enforcement exemption.

Answer

Enforce constraints/compute.trustedImageProjects on the DataOps folder, add projects/dataops-custom-images to the allowed values list, and retain policy inheritance from the parent node.
For list constraints such as `constraints/compute.trustedImageProjects`, setting an allowed value at a child folder level while inheriting from the parent node merges the allowed values. This allows Compute Engine workloads within the `DataOps` folder to consume images from both `projects/corp-base-images` (inherited from the organization root) and `projects/dataops-custom-images` (defined at the folder level).

Step-by-Step Solution

1
Analyze policy inheritance for list constraints in the GCP resource hierarchy.
By default, child nodes inherit allowed values from parent organization policy nodes unless inheritance is explicitly disabled.
Understanding list constraint inheritance allows combining allowed values across hierarchy levels.
2
Evaluate the requirement for allowing both image source projects.
The requirement specifies allowing images from both `projects/corp-base-images` (inherited from the root) and `projects/dataops-custom-images` (added at folder level).
Setting folder allowed values while keeping parent inheritance enabled merges both sets of allowed values.
3
Distinguish IAM permissions from Organization Policy constraints.
IAM roles govern identity actions, whereas Organization Policies establish guardrails that IAM roles cannot override.
Rule out solutions relying on IAM roles (including primitive roles) to override organization policy constraints.

Key Concept

Organization Policy List Constraint Inheritance and Merging
Rate this question

Topics

Configuring Organization Policies and Resource Hierarchy Constraints

More questions from this topic