Examkin

Question

Difficulty: HardConfiguring Organization Policies and Resource Hierarchy Constraints

An enterprise organization manages a Google Cloud resource hierarchy containing an Organization root node, a folder named `Production`, and a child project named `Payment-Service` inside `Production`. The security team wants to enforce strict network perimeter controls and ensure proper administrative access delegation across the environment. Which of the following statements correctly describe the behavior and management of Organization Policies in this resource hierarchy? (Select TWO answers.)

  1. Enforcing an Organization Policy constraint at the `Production` folder level automatically applies the restriction to `Payment-Service` through resource hierarchy inheritance.Answer
  2. Assigning the Organization Policy Admin role (`roles/orgpolicy.policyAdmin`) gives an administrator the authority to configure constraints, but does not inherently grant data access or resource management permissions on Compute Engine instances.Answer
  3. C
    Configuring an Organization Policy constraint to restrict public IP addresses automatically modifies existing IAM policies by revoking network administrator roles from project users.
  4. D
    Users holding the primitive Owner role (`roles/owner`) on `Payment-Service` can automatically bypass Organization Policy constraints enforced at the parent `Production` folder level.

Answer

The correct statements are that Organization Policy constraints enforced at a parent folder level automatically inherit down to child projects, and that the Organization Policy Admin role (`roles/orgpolicy.policyAdmin`) grants permission to manage constraints without conferring permissions to access underlying project resources.
Organization Policies inherit down the Google Cloud resource hierarchy, meaning policies enforced at a parent folder level automatically apply to all contained projects. Furthermore, Google Cloud maintains a strict separation of duties: the `roles/orgpolicy.policyAdmin` role allows administrators to manage policy constraints across the resource hierarchy without giving them access to project-level resource data or management operations.

Step-by-Step Solution

1
Analyze Organization Policy resource hierarchy inheritance behavior.
Constraints defined at higher levels of the hierarchy (such as Folders or the Organization root) pass down to child nodes (such as Projects) automatically.
Google Cloud Organization Policies adhere to hierarchical inheritance unless an explicit restore or override policy is applied at a child node.
2
Evaluate the distinction between Organization Policies and IAM permissions.
Organization Policies set guardrails on resource behaviors (what can be done to resources), whereas IAM roles define identity permissions (who can perform actions).
Enforcing an Organization Policy restriction does not alter IAM policy bindings, nor can IAM roles like `roles/owner` grant immunity from enforced Organization Policies.
3
Examine the scope of the `roles/orgpolicy.policyAdmin` role.
The Organization Policy Admin role provides administrative capabilities over organization policy constraints only, maintaining least privilege separation from workload administration.
Google Cloud enforces separation of duties between compliance policy governance and underlying infrastructure/data management.

Key Concept

Organization Policy inheritance and separation of governance controls from IAM access permissions across the resource hierarchy
Rate this question

Topics

Configuring Organization Policies and Resource Hierarchy Constraints

More questions from this topic