Examkin

Question

Difficulty: MediumOrganization Policies and Constraints

A enterprise media corporation uses a Google Cloud folder structure to separate its digital publishing business unit from other corporate divisions. To satisfy strict corporate governance and compliance mandates, the lead security architect must guarantee that project administrators within this folder cannot grant IAM roles to any external personal accounts or unapproved third-party Google Workspace domains. This restriction must automatically apply to all existing projects and any future projects created within the folder. Which approach should the cloud architect recommend to meet these governance requirements?

  1. Set an Organization Policy using the Domain-Restricted Sharing constraint (constraints/iam.allowedPolicyMemberDomains) on the business unit folder node, specifying the approved Google Workspace customer ID.Answer
  2. B
    Revoke primitive Editor and Owner roles across all folder projects and replace them with custom IAM roles that explicitly disable external domain binding permissions.
  3. C
    Create a VPC Service Controls perimeter encompassing all projects in the folder to block incoming IAM policy modification API calls that originate outside the corporate network.
  4. D
    Grant the Service Account User role (roles/iam.serviceAccountUser) to developers at the Organization root level to centralize identity management and permission assignments.

Answer

Set an Organization Policy using the Domain-Restricted Sharing constraint (constraints/iam.allowedPolicyMemberDomains) on the business unit folder node, specifying the approved Google Workspace customer ID.
Applying an Organization Policy with the `constraints/iam.allowedPolicyMemberDomains` constraint at the targeted folder node enforces a security guardrail across all current and future child projects. It restricts IAM policy modifications so that only identities belonging to the specified Google Workspace customer ID or directory domain can be granted roles.

Step-by-Step Solution

1
Identify the governance objective
The goal is to restrict IAM policy membership strictly to authorized identity domains across a specific sub-hierarchy (folder) automatically.
Security guardrails preventing external account access across multiple projects require centralized constraints.
2
Evaluate Google Cloud governance mechanisms
Organization Policies enforce resource constraints hierarchically across projects, folders, and organizations. The specific constraint for restricting IAM member domains is constraints/iam.allowedPolicyMemberDomains.
IAM roles define what permissions an identity has, while Organization Policies restrict resource configurations and allowed configurations across the hierarchy.
3
Determine the resource hierarchy insertion point
Apply the policy constraint directly on the targeted Folder node.
Hierarchical inheritance ensures all present and future projects under that folder inherit the constraint automatically.

Key Concept

Domain-Restricted Sharing via Organization Policies
Rate this question

Topics

Organization Policies and Constraints

More questions from this topic