Examkin

Question

Difficulty: EasyOrganization Policies and Constraints

An enterprise cloud architect needs to prevent developers from assigning external IP addresses to any new Compute Engine instances created within a specific organizational folder. Which Google Cloud solution should be implemented to enforce this restriction across all projects in the folder?

  1. Configure an Organization Policy with the `constraints/compute.vmExternalIpAccess` constraint applied at the folder level.Answer
  2. B
    Remove primitive IAM roles (Owner, Editor, Viewer) from all developers working within the target projects.
  3. C
    Define a VPC Service Controls perimeter around the projects to prevent data exfiltration over public endpoints.
  4. D
    Revoke the Service Account User role (`roles/iam.serviceAccountUser`) from developer accounts assigned to the compute instances.

Answer

Configure an Organization Policy with the `constraints/compute.vmExternalIpAccess` constraint applied at the folder level.
Applying an Organization Policy with the `constraints/compute.vmExternalIpAccess` constraint at the folder level ensures that all current and future child projects inherit the restriction, preventing any VM instance from being provisioned with an external IP address.

Step-by-Step Solution

1
Identify the governance requirement.
The requirement is to restrict Compute Engine VM instances from being provisioned with external IP addresses within a folder.
Centralized resource configuration restrictions across resource hierarchy nodes require Organization Policy constraints.
2
Select the appropriate constraint and target node.
Applying `constraints/compute.vmExternalIpAccess` at the folder level restricts external IP assignments for all child projects.
Organization Policies control resource configurations independently of IAM identity permissions and inherit down the resource hierarchy.

Key Concept

Organization Policies provide centralized programmatic control over organizational resources by enforcing policy constraints across the GCP resource hierarchy.
Rate this question

Topics

Organization Policies and Constraints

More questions from this topic