Examkin

Question

Difficulty: MediumOrganization Policies and Constraints

An online retail enterprise uses Google Cloud resource hierarchy to manage environments. To reduce risks associated with unauthorized data movement, the security team needs to prevent service accounts created in non-production projects from attached usage or impersonation across project boundaries into production projects. This restriction must apply to all existing and future projects under the 'Non-Production' folder hierarchy without interrupting production service account workflows. Which solution should the principal cloud architect recommend?

  1. A
    Grant project leads the Owner primitive IAM role at the 'Non-Production' folder level to allow them to manually audit and block cross-project service account access.
  2. B
    Define a VPC Service Controls perimeter around the non-production projects to block service account access across projects.
  3. Enforce the boolean Organization Policy constraint `constraints/iam.disableCrossProjectServiceAccountUsage` at the 'Non-Production' folder level.Answer
  4. D
    Grant developers the Service Account Admin role (`roles/iam.serviceAccountAdmin`) across the 'Non-Production' folder so they can configure individual service account keys.

Answer

Enforce the boolean Organization Policy constraint `constraints/iam.disableCrossProjectServiceAccountUsage` at the 'Non-Production' folder level.
Enforcing `constraints/iam.disableCrossProjectServiceAccountUsage` at the folder level is the Google-recommended approach to systematically prevent resources in child projects under that folder from attaching or using service accounts owned by external projects.

Step-by-Step Solution

1
Identify the governance requirement.
The requirement mandates preventing service accounts belonging to one project from being attached to resources or used across project boundaries within a specific folder hierarchy.
Preventing cross-project service account usage limits the lateral movement of compromised identities between non-production and production environments.
2
Evaluate the appropriate governance mechanism in Google Cloud.
Organization Policy constraints enforce centralized guardrails across resource hierarchy nodes (Organization, Folder, or Project).
The predefined boolean constraint `constraints/iam.disableCrossProjectServiceAccountUsage` specifically disables attaching service accounts from other projects.
3
Select the correct resource hierarchy target node.
Enforcing the policy at the 'Non-Production' folder level ensures all current and future projects inherited under that folder automatically adhere to the guardrail.
Inheritance down the Google Cloud resource hierarchy provides central enforcement without requiring per-project manual configuration.

Key Concept

Organization Policy Constraints and Resource Hierarchy Inheritance
Rate this question

Topics

Organization Policies and Constraints

More questions from this topic