Examkin

Question

Difficulty: MediumConfiguring Organization Policies and Resource Hierarchy Constraints

A financial firm enforces an Organization Policy at the root Organization node using the list constraint `constraints/sql.restrictPublicIp` to prevent Cloud SQL instances from being created with public IP addresses. A database team requires public IP access temporarily for instances created inside a specific folder named `Partner-Staging`. How should the administrator configure the governance controls on the `Partner-Staging` folder to allow public IP allocation for SQL instances inside that folder without affecting the rest of the organization?

  1. Set an Organization Policy enforcement override at the `Partner-Staging` folder level for `constraints/sql.restrictPublicIp` to allow public IP configuration.Answer
  2. B
    Grant the Cloud SQL Admin role (`roles/cloudsql.admin`) to the database team at the `Partner-Staging` folder level to bypass the root policy.
  3. C
    Remove the Organization Policy Administrator role from the `Partner-Staging` folder to stop resource hierarchy policy inheritance.
  4. D
    Assign the primitive Owner role (`roles/owner`) to the database team on the `Partner-Staging` folder so they can bypass organization restrictions.

Answer

Set an Organization Policy enforcement override at the `Partner-Staging` folder level for `constraints/sql.restrictPublicIp` to allow public IP configuration.
Organization Policies evaluate resource state restrictions hierarchically. To grant an exception for resources contained within a specific folder, an Organization Policy rule must be applied directly at that folder node to override or reset the inherited constraint from the root organization.

Step-by-Step Solution

1
Identify the governance mechanism required to permit resource configuration exceptions across a specific resource hierarchy node.
Recognize that Organization Policies enforce constraints on resources regardless of user IAM permissions.
IAM grants permissions to identity principals, whereas Organization Policy constraints enforce boundaries on resources.
2
Evaluate how policy constraints propagate through the GCP resource hierarchy.
Child nodes (folders and projects) inherit parent constraints by default unless explicit policy rules or overrides are applied at the lower node level.
Configuring a policy constraint override at the target folder node selectively alters enforcement for resources contained within that folder.

Key Concept

Organization Policy Hierarchy and Inheritance
Rate this question

Topics

Configuring Organization Policies and Resource Hierarchy Constraints

More questions from this topic