Examkin

Question

Difficulty: EasyConfiguring Organization Policies and Resource Hierarchy Constraints

A company needs to enforce a compliance rule that prohibits service account key creation for all Google Cloud projects nested inside the 'Production' folder. What is the correct way to enforce this restriction across all current and future projects in that folder?

  1. Apply an Organization Policy constraint disabling service account key creation at the 'Production' folder level.Answer
  2. B
    Grant the Organization Administrator IAM role to the operations team at the project level.
  3. C
    Revoke primitive Viewer permissions from all users at the organization level.
  4. D
    Assign a custom IAM role to service accounts that excludes key management permissions at the project level.

Answer

Apply an Organization Policy constraint disabling service account key creation at the 'Production' folder level.
Organization Policies allow administrators to configure constraints on specific Google Cloud resources. Applying a policy constraint at a folder level enforces the rule for that folder and automatically propagates down through resource hierarchy inheritance to all child projects.

Step-by-Step Solution

1
Identify the administrative goal and target resources.
The goal is to restrict a specific resource capability (service account key creation) across all existing and future projects within a specific folder.
Resource configuration restrictions applied at scale require Organization Policies rather than individual IAM role grants.
2
Evaluate Google Cloud management tools for restricting resource behaviors.
Organization Policies define constraints on specific Google Cloud services and inherit down the hierarchy (Organization → Folders → Projects).
Applying the constraint at the 'Production' folder ensures all nested projects inherit the restriction automatically.

Key Concept

Organization Policies vs IAM Roles for Resource Hierarchy Constraints
Rate this question

Topics

Configuring Organization Policies and Resource Hierarchy Constraints

More questions from this topic