Examkin

Soru

Zorluk: ZorConfiguring Organization Policies and Resource Hierarchy Constraints

A Google Cloud administrator manages a multi-tier resource hierarchy. At the root Organization node, the list constraint `constraints/gcp.resourceLocations` is configured to allow resources only in `in:us-locations`. The operations team creates a dedicated Folder named `/Europe-Operations` to host European workloads. Developers working inside this folder report that they are unable to create Cloud Storage buckets in `europe-west1`. The administrator must allow resource deployment in `europe-west1` for all projects within `/Europe-Operations` while maintaining existing restrictions across the rest of the organization, without granting developers administrative rights over security policies. Which TWO actions should the administrator perform? (Select TWO.)

  1. Apply a new Organization Policy directly on the `/Europe-Operations` folder node that sets allowed locations to include `europe-west1` and overrides the inherited parent policy rule.Cevap
  2. B
    Assign the `roles/resourcemanager.organizationAdmin` IAM role to the developer group on the `/Europe-Operations` folder node so their IAM permissions supersede the root Organization Policy.
  3. Verify that the administrator performing the policy update holds the Organization Policy Admin (`roles/orgpolicy.policyAdmin`) role on the resource hierarchy node.Cevap
  4. D
    Delete the `constraints/gcp.resourceLocations` policy enforcement at the root Organization node to allow child folder policies to evaluate independently.

Cevap

The administrator should apply a new Organization Policy on the targeted folder node to override inherited rules for allowed location values, and ensure they have the Organization Policy Admin role to execute policy changes.
To resolve location restriction blocks for a specific folder, an administrator must set an Organization Policy override directly on that folder node to allow the needed region, while holding the Organization Policy Admin role (`roles/orgpolicy.policyAdmin`) required to write policy constraints.

Adım Adım Çözüm

1
Analyze resource hierarchy policy evaluation for list constraints.
List constraints set at higher levels (Organization) propagate down to child nodes (Folders and Projects) unless overridden at a lower level node.
To grant exceptions for a specific folder without affecting sibling projects, an override policy must be defined directly at that folder node.
2
Determine required IAM role privileges for policy configuration.
Creating or modifying Organization Policy constraints requires the `roles/orgpolicy.policyAdmin` role.
Standard project or folder administration roles do not automatically include permissions to alter organization policy rules.
3
Evaluate why alternative options violate governance boundaries.
Granting IAM roles cannot bypass Organization Policies, and removing the root constraint exposes all other projects to unapproved regions.
IAM permissions and Organization Policies operate as independent security layers; removing root constraints breaks organizational guardrails.

Anahtar Kavram

Organization Policy Hierarchy Inheritance and Administrative Privileges
Bu soruyu puanla

Konular

Configuring Organization Policies and Resource Hierarchy Constraints

Bu konudan daha fazla soru