Examkin

Question

Difficulty: MediumConfiguring Organization Policies and Resource Hierarchy Constraints

An enterprise security team requires that Compute Engine virtual machines in the 'Data-Processing' folder be prevented from enabling IP forwarding (acting as routers or network gateways), except for one specialized project named 'gw-prod-100' located inside that folder. A cloud engineer must implement this guardrail using the Google Cloud resource hierarchy while granting the explicit exception. Which configuration should the engineer apply?

  1. Enforce the `constraints/compute.vmCanActAsIpForwarder` Organization Policy constraint on the 'Data-Processing' folder, and set the policy constraint to false (enforcement off) at the 'gw-prod-100' project level.Answer
  2. B
    Grant the `roles/orgpolicy.policyAdmin` IAM role at the 'gw-prod-100' project level and assign the Compute Instance Admin role at the 'Data-Processing' folder level.
  3. C
    Apply an IAM deny policy for `compute.instances.create` on the 'Data-Processing' folder and remove all subnet bindings from the 'gw-prod-100' project.
  4. D
    Assign the primitive Owner role to administrators of the 'gw-prod-100' project so that inherited folder constraints are automatically bypassed.

Answer

Enforce the `constraints/compute.vmCanActAsIpForwarder` Organization Policy constraint on the 'Data-Processing' folder, and set the policy constraint enforcement to false at the 'gw-prod-100' project level.
Organization Policy constraints set at a folder level automatically inherit down to all child projects. To grant an exception to a specific project within that folder, the constraint must be explicitly set to false (off) at the project level, which overrides the inherited folder policy.

Step-by-Step Solution

1
Identify the proper Google Cloud mechanism for enforcing infrastructure configuration rules across resource hierarchy nodes.
Organization Policy constraints (such as `constraints/compute.vmCanActAsIpForwarder`) must be used instead of IAM roles.
Organization Policies govern what configurations resources can have, whereas IAM governs identity permissions.
2
Determine the resource hierarchy inheritance behavior for the folder and child project.
Enforcing the constraint at the 'Data-Processing' folder level applies the restriction to all projects in that folder by default.
Organization policies inherit downwards from parent nodes to child nodes.
3
Configure the exception for the target project.
Override the inherited policy at the 'gw-prod-100' project level by setting enforcement to false.
Setting a specific policy setting at a child node overrides inherited parent rules for that specific child node.

Key Concept

Organization Policy Hierarchy and Constraint Inheritance Overrides
Rate this question

Topics

Configuring Organization Policies and Resource Hierarchy Constraints

More questions from this topic