Examkin

Question

Difficulty: Very hardOrganization Policies and Constraints

An enterprise cloud security architect needs to enforce governance guardrails across a Google Cloud organization hierarchy. The mandate requires preventing service account key generation centrally while permitting exceptions for a specific development folder. Additionally, the team must evaluate the impact of restricting external IP attachments on compute instances in production before strict enforcement. Which TWO architectural recommendations achieve these governance objectives?

  1. Apply the boolean constraint `iam.disableServiceAccountKeyCreation` at the Organization root node and configure an inheritance override rule on the non-production Folder node to disable enforcement.Answer
  2. Configure the `compute.vmExternalIpAccess` constraint in dry-run mode at the targeted production Folder node to audit non-compliant public IP configurations in Cloud Audit Logs without interrupting active deployments.Answer
  3. C
    Assign the primitive `roles/owner` role to security administrators at the folder level so they can manually delete service account keys and revoke public IP assignments.
  4. D
    Define a VPC Service Controls security perimeter around production projects to block Compute Engine virtual machines from requesting external IP addresses.

Answer

The cloud architect should apply the `iam.disableServiceAccountKeyCreation` constraint at the organization root with an inheritance override at the non-production folder level, and configure `compute.vmExternalIpAccess` in dry-run mode on the production folder node to audit compliance.
Applying `iam.disableServiceAccountKeyCreation` at the Organization root with a folder-level inheritance override provides centralized governance while allowing exceptions for non-production environments. Configuring `compute.vmExternalIpAccess` in dry-run mode writes violation events to Cloud Audit Logs without blocking workload deployments, enabling risk evaluation prior to full enforcement.

Step-by-Step Solution

1
Evaluate central service account key enforcement and inheritance requirements.
Identify that boolean constraint `iam.disableServiceAccountKeyCreation` applied at the Organization root establishes centralized prevention, which can be overridden at lower folder nodes where required.
Google Cloud Organization Policies inherit down the resource hierarchy unless explicit override rules are defined at folder or project levels.
2
Determine the mechanism for impact evaluation of external IP restrictions.
Select dry-run enforcement mode for the list constraint `compute.vmExternalIpAccess` on the targeted production folder.
Dry-run mode writes audit logs when violations occur without enforcing actual resource creation failure, satisfying the audit-before-enforce requirement.
3
Analyze distractors involving IAM roles and security perimeters.
Reject primitive role assignments and VPC Service Controls for resource constraint governance.
Primitive roles violate least privilege governance, and VPC Service Controls guard against perimeter data exfiltration rather than managing internal resource configuration attributes.

Key Concept

Hierarchy Inheritance and Policy Overrides with Dry-Run Audit Enforcement
Rate this question

Topics

Organization Policies and Constraints

More questions from this topic