Examkin

Question

Difficulty: HardOrganization Policies and Constraints

An enterprise SaaS company manages its Google Cloud infrastructure using an Organization resource hierarchy with two primary folders: `Core-Services` and `Development`. To meet strict corporate compliance standards, the security team must enforce two governance rules:
1. Prevent the creation of external service account keys for all projects located within the `Development` folder.
2. Prevent Compute Engine instances throughout the entire organization from obtaining public IP addresses, with a temporary exception for a single legacy diagnostics project under `Development` that requires public connectivity.

How should the security team configure Google Cloud Organization Policies to enforce these constraints with minimal administrative effort while respecting resource hierarchy inheritance?

  1. Apply the boolean constraint `constraints/iam.disableServiceAccountKeyCreation` at the `Development` folder level. Apply the list constraint `constraints/compute.vmExternalIpAccess` at the Organization root node set to `Deny All`, and configure an Organization Policy rule on the legacy diagnostics project node set to `Allow All`.Answer
  2. B
    Assign primitive Viewer roles to developers within the `Development` folder to prevent service account key creation, and remove the Compute Network Admin role across all projects to prevent external IP attachment.
  3. C
    Configure a VPC Service Controls perimeter around the `Development` folder to prevent service account key creation, and define access levels to block external IP assignments.
  4. D
    Grant the `roles/iam.serviceAccountUser` role at the Organization level to restrict key generation capabilities, and apply global VPC firewall rules denying outbound egress traffic to 0.0.0.0/0.

Answer

Enforce `constraints/iam.disableServiceAccountKeyCreation` on the target folder, enforce `constraints/compute.vmExternalIpAccess` as `Deny All` at the Organization root, and apply a policy override set to `Allow All` on the specific project requiring an exception.
Organization Policies allow centralized governance across the GCP resource hierarchy. Defining the boolean constraint for disabling service account key creation at the `Development` folder node applies restriction to all child projects under that folder. Defining the external IP list constraint at the Organization root establishes an organization-wide default deny behavior, while applying an explicit policy rule set to `Allow All` at the legacy project node overrides parent inheritance for that specific project only.

Step-by-Step Solution

1
Analyze resource hierarchy placement for folder-scoped guardrails.
Identify that applying `constraints/iam.disableServiceAccountKeyCreation` at the `Development` folder node automatically enforces key creation restriction on all descendant projects via inheritance.
Organization policies inherit downwards through the resource hierarchy (Organization → Folder → Project).
2
Evaluate global baseline policies versus localized exceptions.
Apply `constraints/compute.vmExternalIpAccess` with a `Deny All` rule at the Organization level to secure all existing and future projects by default.
Setting baseline security constraints at the highest hierarchy node ensures comprehensive coverage across the entire organization.
3
Configure the policy exception using hierarchical inheritance rules.
Set an explicit policy override on the legacy diagnostics project node to allow VM external IPs (`Allow All`).
Explicit policy rules defined at child nodes override inherited policies from parent nodes for that specific resource.

Key Concept

GCP Organization Policy inheritance and constraint override mechanism across the resource hierarchy.
Rate this question

Topics

Organization Policies and Constraints

More questions from this topic