Examkin

Question

Difficulty: MediumOrganization Policies and Constraints

A financial technology company is establishing central security guardrails for a specific Google Cloud folder containing sensitive payment processing workloads. The enterprise security policy dictates that no Compute Engine virtual machine instances created within this folder should have external IP addresses attached, preventing direct internet accessibility. To avoid disrupting existing production services, the security team needs to audit non-compliant resources first before enforcing strict blocking across all projects in the folder. Which architectural approach meets these governance requirements?

  1. Apply the compute.vmExternalIpAccess organization policy constraint at the target folder level in dry-run mode, monitor violations using Cloud Audit Logs, and then transition the constraint to enforced mode.Answer
  2. B
    Configure a VPC Service Controls perimeter encompassing the payment processing projects and define an egress policy restricting public IP allocation for Compute Engine instances.
  3. C
    Remove the primitive roles/owner and roles/editor IAM roles from project members across the folder and replace them with custom IAM roles that explicitly omit Compute Engine network management permissions.
  4. D
    Revoke the roles/iam.serviceAccountUser role from developers and service accounts associated with Compute Engine workloads inside the payment processing projects.

Answer

Apply the compute.vmExternalIpAccess organization policy constraint at the target folder level in dry-run mode, monitor violations using Cloud Audit Logs, and then transition the constraint to enforced mode.
Organization Policies provide centralized, programmatic control over organization resources. The boolean constraint compute.vmExternalIpAccess specifically controls whether Compute Engine VM instances within the resource hierarchy can be configured with external IP addresses. Applying this constraint at the folder level ensures all projects within that folder inherit the guardrail. Setting the constraint to dry-run mode generates audit log events for non-compliant resources without disrupting existing infrastructure or blocking deployment pipelines during evaluation.

Step-by-Step Solution

1
Identify the appropriate governance mechanism for resource configuration constraints.
Recognize that Google Cloud Organization Policies (specifically compute.vmExternalIpAccess) are designed to restrict specific resource configuration attributes across the resource hierarchy.
IAM roles control identity access rights, and VPC Service Controls protect API perimeters, whereas Organization Policies restrict resource creation properties.
2
Determine the appropriate scope for policy application.
Apply the policy constraint at the specific target Folder node containing payment workloads.
Inheritance will apply the policy to all current and future projects beneath that folder without impacting unrelated folders.
3
Select the policy execution mode for non-disruptive auditing.
Configure the organization policy constraint in dry-run mode initially.
Dry-run policy evaluation logs violations to Cloud Audit Logs without blocking resource creation or interrupting running production workloads, allowing safe operational validation prior to full enforcement.

Key Concept

Organization Policy Constraints and Dry-Run Enforcement
Rate this question

Topics

Organization Policies and Constraints

More questions from this topic