Examkin

Question

Difficulty: MediumConfiguring Organization Policies and Resource Hierarchy Constraints

A cloud security engineer needs to enforce strict security baselines for all new Google Cloud projects created within a resource hierarchy folder named `Production-Workloads`. Specifically, the policy must ensure two outcomes across all current and future projects in that folder: default VPC networks are not created during project initialization, and default service accounts are not automatically granted the primitive Editor role upon creation. Which TWO organization policy constraints must be enforced at the `Production-Workloads` folder level to achieve these requirements?

  1. Enforce the boolean constraint `constraints/compute.skipDefaultVpcCreation`.Answer
  2. Enforce the boolean constraint `constraints/iam.automaticIamGrantsForDefaultServiceAccounts`.Answer
  3. C
    Create an IAM deny policy at the `Production-Workloads` folder level to revoke `roles/editor` from all service accounts.
  4. D
    Remove the `roles/resourcemanager.organizationAdmin` role at the Organization root to disable default resource provisioning.

Answer

The correct configurations are enforcing the boolean organization policy constraints `constraints/compute.skipDefaultVpcCreation` and `constraints/iam.automaticIamGrantsForDefaultServiceAccounts` at the `Production-Workloads` folder level.
To prevent the default VPC from being automatically created during project provision, Google Cloud provides the `constraints/compute.skipDefaultVpcCreation` organization policy. To prevent default service accounts from automatically receiving the Editor role when APIs are enabled, Google Cloud provides the `constraints/iam.automaticIamGrantsForDefaultServiceAccounts` organization policy. Applying both boolean policies at the target folder level ensures all nested projects inherit these security constraints.

Step-by-Step Solution

1
Identify the requirement to disable automatic default VPC creation upon project provisioning.
Recognize that `constraints/compute.skipDefaultVpcCreation` is the predefined Google Cloud Organization Policy constraint designed for this exact purpose.
Applying this constraint at a folder level ensures all child projects inherit the restriction.
2
Identify the requirement to block automatic primitive Editor role grants to default service accounts.
Recognize that `constraints/iam.automaticIamGrantsForDefaultServiceAccounts` is the standard Organization Policy constraint used to suppress automatic IAM role grants.
This enforces the principle of least privilege for newly provisioned compute and API service accounts.
3
Differentiate Organization Policies from IAM roles and access grants.
Select the two boolean Organization Policy constraint options and exclude IAM role management or revocation choices.
IAM permissions control WHO can do WHAT, whereas Organization Policies govern WHAT configurations resources can have.

Key Concept

Organization Policy boolean constraints control resource creation behavior and defaults hierarchically across folders and projects.
Rate this question

Topics

Configuring Organization Policies and Resource Hierarchy Constraints

More questions from this topic