Examkin

Question

Difficulty: HardOrganization Policies and Constraints

A enterprise organization is upgrading its governance posture across its Google Cloud resource hierarchy. The security team mandates that service account key creation must be disabled centrally (`constraints/iam.disableServiceAccountKeyCreation`) to eliminate long-lived credential exposure. However, a legacy workloads folder contains automated deployment scripts that still require key-based authentication while undergoing migration to Workload Identity Federation. The lead cloud architect must enforce the restriction centrally across all existing and future projects while allowing a temporary exception for the legacy workloads folder without compromising the security posture of other departments. Which architectural strategy complies with Google-recommended best practices for Organization Policy management?

  1. Apply the constraints/iam.disableServiceAccountKeyCreation policy set to Enforce at the Organization root node, and configure an explicit policy override at the legacy workloads Folder node that sets Enforce to False.Answer
  2. B
    Revoke the primitive Owner and Editor roles from all developer groups at the Organization level and assign the IAM Workload Identity User role to restrict key generation capabilities across all sub-folders.
  3. C
    Create a VPC Service Controls security perimeter around the legacy workloads folder and configure an egress rule that blocks key generation API calls from leaving the perimeter boundary.
  4. D
    Grant the Service Account User role (roles/iam.serviceAccountUser) to the legacy pipeline service accounts at the Project level while revoking Service Account Admin privileges across the rest of the organization.

Answer

Enforce the constraint at the Organization root node and configure an explicit policy override at the legacy workloads Folder node setting Enforce to False.
Google Cloud Organization Policies follow a top-down inheritance model. Enforcing `constraints/iam.disableServiceAccountKeyCreation` at the Organization root level ensures global security compliance by default. Overriding the policy at the legacy workloads Folder level (setting Enforce to False) selectively allows legacy applications to operate until modernization without granting global exemptions.

Step-by-Step Solution

1
Analyze governance requirements and resource hierarchy mechanics
Organization policies inherit hierarchically from Organization to Folders to Projects.
Setting the policy at the top node ensures all current and future projects inherit the constraint by default.
2
Determine the mechanism for exception management
Child nodes in the GCP resource hierarchy can override parent organization policy rules.
Configuring an override on the legacy workloads folder isolates the exception strictly to projects residing inside that folder.
3
Evaluate alternative security controls
IAM roles and VPC Service Controls serve distinct purposes (identity privileges and network exfiltration boundaries) and cannot replace explicit Organization Policy constraints.
Resource behavior constraints require Organization Policy enforcement rather than permission grants or network perimeters.

Key Concept

Organization Policy Resource Hierarchy Inheritance and Overrides
Estimated Time:2m 0s
Rate this question

Topics

Organization Policies and Constraints

More questions from this topic