Examkin

Question

Difficulty: HardOrganization Policies and Constraints

An enterprise cloud governance architect must enforce baseline security constraints on a newly acquired subsidiary's folder structure within Google Cloud. The governance mandate requires restricting resource deployment exclusively to specified European regions and preventing default service accounts from automatically receiving the Editor primitive role upon API enablement. These policies must apply to all current and future projects under the subsidiary folder without affecting legacy projects outside this folder hierarchy. Which TWO Organization Policy constraints should the architect enforce at the subsidiary folder level to achieve these requirements? (Select TWO)

  1. Enforce the list constraint constraints/gcp.resourceLocations with an allowed values list containing only the approved European regions.Answer
  2. Enforce the boolean constraint constraints/iam.automaticIamGrantsForDefaultServiceAccounts on the target folder.Answer
  3. C
    Construct a VPC Service Controls perimeter around the subsidiary folder resources and configure ingress rules to restrict compute deployment locations.
  4. D
    Grant the primitive roles/owner IAM role to security administrators at the organization node so they can manually revoke default service account roles.

Answer

The architect must enforce the list constraint constraints/gcp.resourceLocations with an allowed values list of approved regions, and enforce the boolean constraint constraints/iam.automaticIamGrantsForDefaultServiceAccounts at the subsidiary folder level.
Enforcing the constraints/gcp.resourceLocations list constraint limits physical resource creation to the defined European regions. Enforcing the constraints/iam.automaticIamGrantsForDefaultServiceAccounts boolean constraint prevents GCP from automatically binding the primitive Editor role to default service accounts upon API activation. Applying both policies at the folder level ensures hierarchical inheritance across all subsidiary child projects while isolating existing legacy workloads outside the folder.

Step-by-Step Solution

1
Identify the constraint required for geographic resource placement restrictions.
Selected constraints/gcp.resourceLocations list constraint.
Organization Policies support location restriction list constraints to limit where GCP resources can physically reside across a folder hierarchy.
2
Identify the constraint required to prevent default service accounts from receiving broad primitive permissions.
Selected constraints/iam.automaticIamGrantsForDefaultServiceAccounts boolean constraint.
By default, enabling certain GCP APIs grants default service accounts the primitive Editor role; enforcing this boolean constraint disables that automatic role grant.
3
Determine the resource hierarchy node for policy application.
Apply both policies at the subsidiary folder level.
Organization policies applied at a folder node inherit down to sub-folders and child projects, scoping governance strictly to the subsidiary without affecting external legacy workloads.

Key Concept

Resource hierarchy policy inheritance and Organization Policy constraints for location and IAM defaults.
Rate this question

Topics

Organization Policies and Constraints

More questions from this topic