Examkin

Question

Difficulty: MediumOrganization Policies and Constraints

A financial analytics company manages its cloud resources using Google Cloud folders to isolate production workloads. The security team mandates that no virtual machine (VM) instances created inside any project under the 'Analytics-Production' folder may be assigned public IP addresses. This security constraint must apply automatically to all existing and future projects created within this folder. Which approach should the Cloud Architect take to enforce this constraint centrally with minimal operational overhead?

  1. Apply an Organization Policy at the 'Analytics-Production' folder level enforcing the `constraints/compute.vmExternalIpAccess` boolean constraint as Deny.Answer
  2. B
    Revoke the primitive Editor and Owner IAM roles from project administrators at the organization level and grant only fine-grained Compute Viewer roles.
  3. C
    Construct a VPC Service Controls perimeter encompassing the 'Analytics-Production' folder and restrict all outbound network traffic.
  4. D
    Remove the Service Account User role (`roles/iam.serviceAccountUser`) from all compute engineers working within the production folder.

Answer

Apply an Organization Policy at the 'Analytics-Production' folder level enforcing the `constraints/compute.vmExternalIpAccess` constraint.
Applying an Organization Policy with the constraint `constraints/compute.vmExternalIpAccess` enforced as Deny at the parent folder level enforces programmatic guardrails across all contained projects. Any attempt to attach a public IP to a VM instance within this folder will be rejected automatically.

Step-by-Step Solution

1
Identify the target resource hierarchy node
The requirement specifies enforcing the rule across all current and future projects under the 'Analytics-Production' folder.
Applying guardrails at the parent folder ensures inherited enforcement without needing per-project manual configuration.
2
Select the appropriate Google Cloud governance feature for resource constraints
Organization Policy constraints regulate configuration properties (such as external IPs on VMs).
Organization Policies define strict guardrails on resources regardless of IAM permissions.
3
Apply the boolean constraint `constraints/compute.vmExternalIpAccess`
External IP address allocation on VM instances within the folder hierarchy is denied.
This specific constraint directly controls whether Compute Engine instances can have external IP interfaces.

Key Concept

Organization Policies and Constraints
Rate this question

Topics

Organization Policies and Constraints

More questions from this topic