Examkin

Soru

Zorluk: KolayConfiguring Organization Policies and Resource Hierarchy Constraints

An administrator needs to establish resource constraints on a folder named 'Staging'. The requirements state that developers must not be allowed to create external service account keys, and Compute Engine virtual machines in this folder must be restricted from obtaining public IP addresses. Which two Organization Policy constraint configurations directly fulfill these security requirements? (Select TWO.)

  1. Enforce the 'iam.disableServiceAccountKeyCreation' constraint on the 'Staging' folder.Cevap
  2. Configure the 'compute.vmExternalIpAccess' constraint to deny external IP allocations on the 'Staging' folder.Cevap
  3. C
    Assign the primitive Viewer IAM role to developers on the 'Staging' folder to block service account key generation.
  4. D
    Grant project-level IAM role bindings to override and disable parent folder restrictions.

Cevap

Enforce the 'iam.disableServiceAccountKeyCreation' constraint on the 'Staging' folder and configure the 'compute.vmExternalIpAccess' constraint to deny external IP allocations on the 'Staging' folder.
Organization Policy constraints are programmatic guardrails applied to resource hierarchy nodes. Enforcing 'iam.disableServiceAccountKeyCreation' blocks key export, and setting 'compute.vmExternalIpAccess' to deny external IP assignment restricts public IP access for all projects in the designated folder.

Adım Adım Çözüm

1
Identify the target resource hierarchy node for policy application.
Select the 'Staging' folder as the target scope.
Applying Organization Policy constraints at the folder level ensures automatic inheritance across all contained projects.
2
Identify the constraint for service account key restriction.
Enforce 'iam.disableServiceAccountKeyCreation'.
This specific Organization Policy constraint stops users from creating service account JSON/P12 keys.
3
Identify the constraint for public IP restriction.
Configure 'compute.vmExternalIpAccess' to deny external IPs.
This constraint restricts Compute Engine instances from being assigned external IP addresses.

Anahtar Kavram

Organization Policy Constraints and Resource Hierarchy Inheritance
Bu soruyu puanla

Konular

Configuring Organization Policies and Resource Hierarchy Constraints

Bu konudan daha fazla soru