Examkin

Question

Difficulty: MediumOrganization Policies and Constraints

A healthcare organization manages its Google Cloud environment using a folder hierarchy where all production database workloads reside under a dedicated folder named Database-Prod. To comply with data sovereignty regulations, the security team must mandate that all resources provisioned within this folder can only be located in us-central1 and us-west1. The guardrail must apply automatically to all existing and future projects created within the Database-Prod folder without relying on custom deployment scripts or per-user IAM permissions. Which configuration correctly satisfies this requirement?

  1. Apply an Organization Policy at the Database-Prod folder level for the Resource Locations constraint (constraints/gcp.resourceLocations), specifying an allowed list containing us-central1 and us-west1.Answer
  2. B
    Assign the primitive Owner role (roles/owner) to the security governance team at the Database-Prod folder level, relying on manual resource reviews to block non-compliant deployments.
  3. C
    Create a VPC Service Controls perimeter around the Database-Prod folder and rely exclusively on data exfiltration rules to restrict resource deployment regions.
  4. D
    Grant the Service Account User role (roles/iam.serviceAccountUser) to developers across the Database-Prod folder to restrict where resources can be provisioned.

Answer

Apply an Organization Policy at the Database-Prod folder level for the Resource Locations constraint (constraints/gcp.resourceLocations), specifying an allowed list containing us-central1 and us-west1.
The Organization Policy service provides centralized governance controls over resource configurations. By binding an Organization Policy containing the constraints/gcp.resourceLocations list constraint to the Database-Prod folder, Google Cloud enforces an explicit allowlist for us-central1 and us-west1. Because Organization Policies inherit down the resource hierarchy, all current and future projects inside that folder inherit this policy automatically.

Step-by-Step Solution

1
Identify the administrative requirement and scope
The requirement demands continuous, automated enforcement of regional resource limits at the folder level across existing and future child projects.
Governance guardrails operating across resource hierarchies are best enforced via Google Cloud Organization Policies.
2
Select the appropriate Organization Policy constraint
Identify constraints/gcp.resourceLocations as the designated list constraint for restricting geographic deployment locations.
This policy constraint allows administrators to explicitly define allowed or denied locations for GCP services.
3
Determine the resource hierarchy binding point
Apply the policy directly to the Database-Prod folder node with allowed values set to us-central1 and us-west1.
Policy inheritance automatically propagates constraints down to all descendant projects and resources within that folder branch.

Key Concept

Organization Policy Resource Location Constraints
Rate this question

Topics

Organization Policies and Constraints

More questions from this topic