Examkin

Question

Difficulty: EasyOrganization Policies and Constraints

An enterprise security administrator needs to ensure that virtual machines created inside a specific environment folder cannot be configured with public IP addresses. Which GCP mechanism should be configured at the folder level to enforce this restriction?

  1. Configure an Organization Policy constraint that restricts external IP access for virtual machines.Answer
  2. B
    Revoke primitive IAM Owner and Editor roles from project users and assign fine-grained predefined roles.
  3. C
    Define a VPC Service Controls perimeter around all the projects within the target folder.
  4. D
    Assign the Service Account User role to compute service accounts instead of Service Account Admin.

Answer

Configure an Organization Policy constraint that restricts external IP access for virtual machines.
Applying an Organization Policy with a constraint to restrict external IP access at the folder level enforces a centralized guardrail across all descendant projects. Organization Policies govern resource configuration properties independent of user IAM permissions.

Step-by-Step Solution

1
Identify the core requirement
The goal is to restrict a specific compute infrastructure attribute (public IP assignment) across an entire folder hierarchy.
Organization Policies are specifically designed to set centralized constraints on GCP resources at the Organization, Folder, or Project level.
2
Select the appropriate GCP governance tool
Applying an Organization Policy constraint at the Folder level ensures all current and future child projects inherit the restriction.
Organization Policy constraints take precedence over individual user IAM permissions and restrict resource configurations declaratively.

Key Concept

Organization Policies and Constraints
Rate this question

Topics

Organization Policies and Constraints

More questions from this topic