Examkin

Question

Difficulty: HardOrganization Policies and Constraints

An enterprise cloud architecture team is implementing governance controls for a newly acquired business unit organized under a dedicated Google Cloud folder. The compliance mandate requires that all resource creation be strictly limited to specified approved regions (`us-central1` and `us-east4`). To prevent operational disruptions to ongoing automated deployments, the security team needs to evaluate existing infrastructure and incoming requests for non-compliance without actively blocking deployments during the initial phase. Which TWO actions should the cloud architect take to satisfy these requirements?

  1. Configure an Organization Policy at the target folder level using the `constraints/gcp.resourceLocations` list constraint with allowed values set to the approved regions, and enable dry-run mode.Answer
  2. Monitor Cloud Audit Logs for dry-run Organization Policy violation events to audit non-compliant resource creation attempts before changing the policy enforcement mode to active denial.Answer
  3. C
    Grant primitive Owner roles to the security compliance team across all child projects under the folder so they can manually revoke resource creation permissions for non-approved regions.
  4. D
    Define a VPC Service Controls perimeter encompassing the folder and configure egress rules to restrict data exfiltration to unauthorized geographical location endpoints.

Answer

The cloud architect should set the list constraint `constraints/gcp.resourceLocations` in dry-run mode at the folder level and analyze Cloud Audit Logs for dry-run policy violations before enforcing strict denial.
To restrict resource deployment locations across a folder hierarchy without disrupting live operations, Google Cloud recommends using the `constraints/gcp.resourceLocations` list constraint in dry-run mode. This approach logs violations to Cloud Audit Logs so administrators can identify non-compliant workloads before enforcing active denial.

Step-by-Step Solution

1
Identify the appropriate policy constraint and scope for location restrictions.
Selected `constraints/gcp.resourceLocations` applied at the designated folder level.
Organization Policy list constraints dictate allowed physical deployment locations for GCP resources across all projects inherited under a specific folder.
2
Enable non-disruptive testing mode for the Organization Policy.
Policy configured with dry-run enforcement mode.
Dry-run mode evaluates incoming deployment requests against the policy without blocking execution, allowing pipelines to remain active while gathering compliance telemetry.
3
Establish visibility into compliance violations.
Audited policy violation entries via Cloud Audit Logs.
When dry-run mode is enabled, violations generate audit log entries that allow security teams to inspect non-compliant workloads and prepare remediation plans before enforcing hard restrictions.

Key Concept

Organization Policy List Constraints and Dry-Run Enforcement
Rate this question

Topics

Organization Policies and Constraints

More questions from this topic