Examkin

Question

Difficulty: Very hardConfiguring Organization Policies and Resource Hierarchy Constraints

An enterprise organization manages a Google Cloud resource hierarchy containing an Organization root node, a Production folder, and a Development folder. At the Organization root level, a Boolean Organization Policy constraint named `constraints/compute.disableGlobalExternalIpAccess` is configured with enforcement enabled (`enforce: true`). The cloud operations team must permit Compute Engine instances within the Development folder to use global external IP addresses, while ensuring the Production folder strictly maintains the prohibition. Furthermore, changes to the organization policy must follow the principle of least privilege. Which TWO actions or policy principles must be applied to achieve this configuration? (Select TWO.)

  1. Configure an explicit Organization Policy on the Development folder for `constraints/compute.disableGlobalExternalIpAccess` and set `enforce: false` to override the inherited restriction.Answer
  2. B
    Grant developers the `roles/resourcemanager.organizationAdmin` role on the Development folder so their IAM permissions override the organization policy enforcement.
  3. Assign the Organization Policy Administrator role (`roles/orgpolicy.policyAdmin`) to the administrator responsible for setting constraints on the resource hierarchy nodes.Answer
  4. D
    Create an IAM deny policy at the Production folder level to revoke external IP allocation permissions for all service accounts in the Development folder.

Answer

To allow external IP creation under the Development folder while enforcing restrictions on the Production folder, an explicit Organization Policy with enforcement set to false must be applied to the Development folder to override the inherited parent constraint. Additionally, modifying Organization Policies requires granting the Organization Policy Administrator role (`roles/orgpolicy.policyAdmin`) according to least-privilege administrative standards.
Child resource hierarchy nodes inherit Organization Policy enforcement settings from parent nodes, but an administrator with the `roles/orgpolicy.policyAdmin` role can override inherited Boolean constraints by explicitly setting `enforce: false` on the lower-level node (such as the Development folder).

Step-by-Step Solution

1
Analyze resource hierarchy inheritance for Organization Policy constraints.
By default, child folders inherit the `enforce: true` setting for `constraints/compute.disableGlobalExternalIpAccess` from the Organization root.
Organization policies propagate down the resource hierarchy unless explicitly overridden at a lower node.
2
Determine how to override a Boolean Organization Policy constraint for a specific child folder.
Setting an explicit Organization Policy on the Development folder with `enforce: false` restores the ability to allocate external IP addresses for projects within that folder without altering the constraint on the Production folder.
Node-level explicit policies override inherited parent policies.
3
Identify the required IAM privilege for managing Organization Policies.
Assign `roles/orgpolicy.policyAdmin` to the administrator modifying the policy.
This predefined role grants exact permissions to manage constraints while upholding the principle of least privilege.

Key Concept

Organization Policy inheritance evaluation and discrete administrative role delegation
Rate this question

Topics

Configuring Organization Policies and Resource Hierarchy Constraints

More questions from this topic