Examkin

Soru

Zorluk: OrtaConfiguring Organization Policies and Resource Hierarchy Constraints

A security audit team for a digital healthcare provider needs to enforce strict network perimeter controls across all Compute Engine virtual machines residing in a specific folder named 'Data Processing'. They want to ensure no instances in this folder receive external IP addresses and that policy administrative duties follow the principle of least privilege. Which TWO actions should the team take to meet these governance requirements? (Select TWO.)

  1. Set the `constraints/compute.vmExternalIpAccess` list constraint on the 'Data Processing' folder to deny external IP address allocation for child VM instances.Cevap
  2. Grant the Organization Policy Admin role (`roles/orgpolicy.policyAdmin`) to the security auditors so they can configure hierarchy constraints without full administrative ownership.Cevap
  3. C
    Grant the primitive Owner role (`roles/owner`) on the folder to the security auditors to allow management of resource constraints across child projects.
  4. D
    Configure IAM policy bindings on child projects to grant access rights that override and bypass the folder's policy restrictions for trusted service accounts.

Cevap

The correct actions are enforcing the `constraints/compute.vmExternalIpAccess` list constraint on the folder level and assigning the Organization Policy Admin (`roles/orgpolicy.policyAdmin`) role to the security auditors.
To restrict external IP configuration on VMs within a folder while following least privilege, administrators must apply the `constraints/compute.vmExternalIpAccess` list constraint directly to the target folder and grant administrators the specialized Organization Policy Admin role (`roles/orgpolicy.policyAdmin`).

Adım Adım Çözüm

1
Identify the appropriate Organization Policy constraint to restrict external IP access on Compute Engine VMs.
The `constraints/compute.vmExternalIpAccess` constraint effectively blocks public IP assignment across all project instances under the folder hierarchy.
Organization Policies enforce physical resource configuration restrictions top-down through the resource hierarchy.
2
Determine the least-privilege IAM role required for managing Organization Policies.
Assigning `roles/orgpolicy.policyAdmin` allows security engineers to define constraint policies without giving them full primitive ownership.
Predefined roles limit permission scope to specific operational tasks compared to broad primitive roles.

Anahtar Kavram

Configuring Organization Policies and Resource Hierarchy Constraints with Least Privilege IAM Roles
Bu soruyu puanla

Konular

Configuring Organization Policies and Resource Hierarchy Constraints

Bu konudan daha fazla soru