Examkin

Question

Difficulty: MediumOrganization Policies and Constraints

A financial enterprise is establishing governance controls across its Google Cloud Organization hierarchy. The security compliance team requires that virtual machines cannot be assigned external public IP addresses and that all new infrastructure resources are restricted to the `us-central1` and `europe-west1` regions. Which TWO Organization Policy constraints should the cloud architect implement to enforce these administrative controls?

  1. Set the `constraints/compute.vmExternalIpAccess` organization policy constraint to deny external IP address allocation on compute instances.Answer
  2. Set the `constraints/gcp.resourceLocations` organization policy constraint to allow resource creation only within `us-central1` and `europe-west1`.Answer
  3. C
    Configure a VPC Service Controls security perimeter around the projects to prevent external IP assignments and enforce regional resource boundaries.
  4. D
    Grant the primitive `roles/owner` role to security administrators at the organization node so they can manually prevent external IP assignment and regional drift.

Answer

The cloud architect should configure the `constraints/compute.vmExternalIpAccess` constraint to block public IP assignment on VMs and the `constraints/gcp.resourceLocations` constraint to limit resource creation to the specified allowed regions.
The combination of the `constraints/compute.vmExternalIpAccess` constraint (which restricts public IP assignment to compute instances) and the `constraints/gcp.resourceLocations` constraint (which limits resource creation to designated GCP regions) centrally enforces the security and compliance requirements across the organization.

Step-by-Step Solution

1
Identify the constraint required for external IP prevention on VMs.
Selecting `constraints/compute.vmExternalIpAccess` prevents Compute Engine instances from receiving external IPv4 or IPv6 addresses.
Organization policies provide programmatic constraints on Compute Engine networking options.
2
Identify the constraint required to restrict resource provisioning regions.
Selecting `constraints/gcp.resourceLocations` with an allowed list containing `us-central1` and `europe-west1` restricts resource deployment geographically.
Resource location constraints define regional boundaries across all supported GCP services in the resource hierarchy.

Key Concept

Organization Policy constraints define centralized programmatic guardrails across the GCP resource hierarchy to enforce security and compliance standards.
Rate this question

Topics

Organization Policies and Constraints

More questions from this topic