Examkin

Question

Difficulty: MediumConfiguring Organization Policies and Resource Hierarchy Constraints

A cloud administrator is setting up centralized compliance controls for a data analytics department organized inside a Google Cloud folder named 'Analytics'. The administrator needs to prevent Cloud Storage buckets within any projects under this folder from being publicly accessible, and also ensure that new projects under this folder do not automatically create a default VPC network. Which TWO of the following configurations correctly achieve these objectives using Organization Policies?

  1. Apply the `constraints/storage.publicAccessPrevention` constraint at the 'Analytics' folder level and configure it to enforce public access prevention for all nested projects.Answer
  2. Apply the `constraints/compute.skipDefaultVpcCreation` constraint at the 'Analytics' folder level to disable automatic default network creation when new projects are created.Answer
  3. C
    Grant the Organization Policy Administrator role (`roles/orgpolicy.policyAdmin`) to the service accounts managing project creation under the 'Analytics' folder to restrict public bucket creation.
  4. D
    Attach an IAM Deny policy at the child project level to override and revoke inherited Organization Policy restrictions enforced at the parent folder level.

Answer

The correct configurations are enforcing `constraints/storage.publicAccessPrevention` at the 'Analytics' folder level and enforcing `constraints/compute.skipDefaultVpcCreation` at the same folder level.
To satisfy both requirements, an administrator must enforce specific Organization Policy constraints at the target folder level ('Analytics'). Setting `constraints/storage.publicAccessPrevention` prevents public bucket exposure across all contained projects. Setting `constraints/compute.skipDefaultVpcCreation` ensures that auto-creation of default VPC networks is skipped whenever a new project is created in that folder.

Step-by-Step Solution

1
Identify the required guardrail for restricting public Cloud Storage access across child projects.
Determine that the predefined Organization Policy constraint `constraints/storage.publicAccessPrevention` enforces public access restrictions across all projects in the target folder.
Organization policies inherit down the resource hierarchy from folders to child projects.
2
Identify the required guardrail for preventing automatic default VPC creation in newly created projects.
Determine that the boolean constraint `constraints/compute.skipDefaultVpcCreation` controls automatic network creation during project provisioning.
Applying this constraint at the folder level ensures all newly created projects under the 'Analytics' folder inherit the restriction.
3
Evaluate distractors related to IAM roles and policy inheritance.
Reject options that confuse IAM permissions with Organization Policy constraint enforcement or attempt to override Org Policies using IAM Deny rules.
Organization Policies constrain resource configurations, whereas IAM rules govern user/service account permissions.

Key Concept

Organization Policy constraints enforced at a folder level automatically inherit down the resource hierarchy to all contained projects, allowing centralized enforcement of resource restrictions such as public storage prevention and default network creation suppression.
Estimated Time:1m 30s
Rate this question

Topics

Configuring Organization Policies and Resource Hierarchy Constraints

More questions from this topic