Examkin

Question

Difficulty: MediumConfiguring Organization Policies and Resource Hierarchy Constraints

A cloud engineer needs to ensure that no Virtual Machine instances created inside any project within the 'Data-Analytics' folder can be provisioned with external IP addresses. Developers currently hold project-level permissions that allow them to configure network interfaces. Which configuration should the engineer implement to enforce this restriction across all current and future projects in the folder?

  1. Set the `constraints/compute.vmExternalIpAccess` Organization Policy constraint at the 'Data-Analytics' folder level to block external IPs.Answer
  2. B
    Remove the `roles/compute.networkAdmin` IAM role at the Organization root node so it inherits down to the 'Data-Analytics' folder.
  3. C
    Assign the primitive `Viewer` role to developers at the 'Data-Analytics' folder level to override project-level Compute Engine permissions.
  4. D
    Replace all predefined Compute Engine roles across projects with a custom IAM role that disables external IP provisioning capabilities.

Answer

Enforce the Organization Policy constraint `constraints/compute.vmExternalIpAccess` at the 'Data-Analytics' folder level to restrict external IP assignment for all child projects.
The correct approach is applying the Organization Policy constraint `constraints/compute.vmExternalIpAccess` at the folder level. Organization Policies allow administrators to restrict resource configuration attributes across all projects contained within a folder, overriding any individual user's IAM permissions to create external IP interfaces.

Step-by-Step Solution

1
Identify the governance requirement.
The requirement calls for a programmatic restriction on resource attributes (external IPs) across a folder hierarchy regardless of user IAM privileges.
Organization Policies are specifically designed to define constraints on resource configurations across Google Cloud resource hierarchy nodes.
2
Select the appropriate constraint mechanism.
The `constraints/compute.vmExternalIpAccess` constraint restricts Compute Engine instances from receiving external IP addresses.
Applying this constraint at the folder level ensures that all existing and future projects beneath that folder inherit the restriction automatically.

Key Concept

Organization Policies vs IAM Governance in Google Cloud
Rate this question

Topics

Configuring Organization Policies and Resource Hierarchy Constraints

More questions from this topic