Examkin

Question

Difficulty: Very hardOrganization Policies and Constraints

A multinational enterprise manages a multi-tier Google Cloud resource hierarchy containing active production workloads across several folders. To comply with new data sovereignty regulations, the security team must restrict all future resource deployments to specified US regions (`in:us-locations`). They need to identify existing non-compliant resources across all projects without disrupting running workloads or blocking active CI/CD deployments during a 30-day evaluation period. Furthermore, once evaluation completes, the restriction must be globally enforced across the entire organization hierarchy while preventing project owners from overriding the constraint. Which Google Cloud strategy achieves these governance objectives?

  1. Configure an Organization Policy at the organization root using the `gcp.resourceLocations` constraint configured in dry-run mode. Monitor compliance violations in Cloud Audit Logs during the evaluation period, and then update the policy enforcement state to active across the organization root.Answer
  2. B
    Assign the primitive `roles/owner` role to the central security audit team across all projects in the organization hierarchy so they can manually inspect resource location settings and modify IAM policies on non-compliant workloads.
  3. C
    Establish a VPC Service Controls perimeter around all folders in the organization hierarchy and configure access levels to block data exfiltration attempts originating from non-US IP addresses.
  4. D
    Grant the `roles/iam.serviceAccountUser` role to all CI/CD deployment service accounts at the project level and mandate that deployment scripts validate regional deployment flags prior to API invocation.

Answer

Configure an Organization Policy using the `gcp.resourceLocations` constraint in dry-run mode at the organization root, audit violations via Cloud Audit Logs, and subsequently switch the policy to active enforcement.
The correct strategy uses Google Cloud Organization Policies with the `gcp.resourceLocations` constraint set to dry-run mode. Dry-run enforcement allows administrators to audit and evaluate potential policy violations via Cloud Audit Logs without blocking active operations or breaking CI/CD pipelines. Once the audit period concludes, enabling active enforcement at the organization root enforces strict compliance across all child folders and projects through hierarchical inheritance.

Step-by-Step Solution

1
Identify the governance requirement and select the appropriate constraint.
The `gcp.resourceLocations` list constraint centralized at the organization root restricts regional creation of supported GCP resources.
Organization Policies provide centralized, policy-driven control over cloud resources across the entire resource hierarchy.
2
Apply the policy in dry-run mode across the organization root.
Deployment requests that violate `in:us-locations` write audit log entries but are allowed to succeed without breaking production pipelines or existing infrastructure.
Dry-run policy evaluation enables risk-free compliance testing and auditing across active environments.
3
Transition from dry-run to enforced status after the 30-day evaluation window.
The constraint actively prevents any new non-US resource creation across all child folders and projects, overriding any project-level configurations.
Hierarchical inheritance ensures root-level enforcement applies universally unless explicit allowed overrides exist.

Key Concept

Organization Policy dry-run mode and resource location constraints
Rate this question

Topics

Organization Policies and Constraints

More questions from this topic