Examkin

Question

Difficulty: EasyOrganization Policies and Constraints

An enterprise security architect wants to prevent developers from creating service account keys and ensure that Compute Engine resources can only be deployed in specific approved Google Cloud regions across all projects contained within the `Production` folder. Which TWO Organization Policy constraints should be configured to satisfy these governance requirements? (Select TWO.)

  1. Enforce `constraints/iam.disableServiceAccountKeyCreation` at the `Production` folder level.Answer
  2. Enforce `constraints/gcp.resourceLocations` with an allowed locations list at the `Production` folder level.Answer
  3. C
    Grant the primitive Viewer role (`roles/viewer`) to developer identities at the `Production` folder level.
  4. D
    Configure a VPC Service Controls perimeter encompassing the `Production` folder to restrict resource creation and API access.

Answer

The correct policy constraints to enforce at the `Production` folder level are `constraints/iam.disableServiceAccountKeyCreation` to block key creation and `constraints/gcp.resourceLocations` to restrict regional deployments.
Enforcing `constraints/iam.disableServiceAccountKeyCreation` directly disables service account key creation, and enforcing `constraints/gcp.resourceLocations` limits infrastructure deployment to specified regions. Configured at the folder level, these constraints automatically govern all child projects.

Step-by-Step Solution

1
Identify the requirement for disabling service account key creation.
Recognize that `constraints/iam.disableServiceAccountKeyCreation` is the built-in Organization Policy constraint designed specifically to block service account key generation.
Organization policies provide central declarative control over resource behaviors across the hierarchy.
2
Identify the requirement for restricting geographic resource deployment.
Recognize that `constraints/gcp.resourceLocations` allows administrators to specify an allowlist of Google Cloud regions for resource creation.
This constraint restricts resource provisioning to approved regions to maintain data sovereignty and regulatory compliance.
3
Determine the appropriate scope for enforcement.
Apply both constraints at the `Production` folder level so all nested child projects inherit the governance rules.
Applying policies at the folder level ensures uniform inheritance across all current and future projects under that folder.

Key Concept

Organization Policy Constraints for IAM Security and Location Restrictions
Rate this question

Topics

Organization Policies and Constraints

More questions from this topic