Examkin

Question

Difficulty: EasyOrganization Policies and Constraints

A cloud administrator needs to ensure that Compute Engine virtual machines created within a specific environment folder cannot be assigned public IP addresses. Which Google Cloud mechanism should be used to enforce this restriction across all projects within that folder?

  1. Apply the `constraints/compute.vmExternalIpAccess` Organization Policy constraint at the target folder level to restrict external IP addresses.Answer
  2. B
    Grant the primitive Owner role (`roles/owner`) to project administrators so they can audit and remove public IP configurations.
  3. C
    Define a VPC Service Controls perimeter around the folder to block external network interface configuration.
  4. D
    Assign the Service Account User role (`roles/iam.serviceAccountUser`) to developers across all projects in the folder.

Answer

Apply the `constraints/compute.vmExternalIpAccess` Organization Policy constraint at the target folder level to restrict external IP addresses.
Applying the `constraints/compute.vmExternalIpAccess` Organization Policy constraint at the folder level programmatically prevents any VM created within child projects from receiving external IP addresses, fulfilling the organizational compliance mandate.

Step-by-Step Solution

1
Identify the governance requirement.
The requirement is to prevent VM instances from receiving public IP addresses across an entire folder.
Centralized resource configuration guardrails are managed via Organization Policies.
2
Select the appropriate constraint.
The `constraints/compute.vmExternalIpAccess` constraint defines rules governing external IP address configuration on Compute Engine instances.
Applying this constraint at a folder node ensures all child projects automatically inherit the policy restriction.

Key Concept

Organization Policies and Constraints
Rate this question

Topics

Organization Policies and Constraints

More questions from this topic