Examkin

Question

Difficulty: MediumConfiguring Organization Policies and Resource Hierarchy Constraints

An enterprise organization requires that all Compute Engine virtual machine instances residing within a folder named 'Production' mandate OS Login for user authentication to disable instance-level SSH keys. Which approach correctly enforces this constraint across the resource hierarchy?

  1. Apply the constraints/compute.requireOsLogin Organization Policy constraint at the 'Production' folder level and set its enforcement to Enforced.Answer
  2. B
    Grant the Compute Instance Admin IAM role at the 'Production' folder level with a conditional deny expression for instance metadata keys.
  3. C
    Apply the constraints/compute.requireOsLogin Organization Policy constraint separately on each child project, because folder-level policies do not inherit down to project resources.
  4. D
    Assign the primitive Owner role to the Security Operations group on the 'Production' folder to automatically activate OS Login enforcement.

Answer

Apply the constraints/compute.requireOsLogin Organization Policy constraint at the 'Production' folder level with enforcement enabled.
Applying the boolean constraint `constraints/compute.requireOsLogin` at the folder level and enabling enforcement ensures that all virtual machines created within child projects under the 'Production' folder are mandated to use OS Login, suppressing instance-level SSH key access through inherited resource hierarchy guardrails.

Step-by-Step Solution

1
Identify the proper mechanism for restricting resource configurations across a resource hierarchy subset.
Recognize that Organization Policy constraints (such as constraints/compute.requireOsLogin) govern resource behaviors, while IAM policies grant permissions.
Organization Policies allow administrators to set programmatic restrictions across organizations, folders, or projects.
2
Determine the optimal resource hierarchy location for policy application.
Target the 'Production' folder level.
Setting the policy at the folder level ensures centralized governance for all current and future child projects in that folder without requiring manual per-project configuration.
3
Verify policy inheritance rules in Google Cloud.
Confirm that folder-level enforcement trickles down to all contained projects.
Resource hierarchy inheritance ensures child nodes inherit parent organization policy constraints unless an explicit override is configured.

Key Concept

Organization Policy Enforcement and Resource Hierarchy Inheritance
Estimated Time:1m 30s
Rate this question

Topics

Configuring Organization Policies and Resource Hierarchy Constraints

More questions from this topic