Examkin

Soru

Zorluk: OrtaConfiguring Organization Policies and Resource Hierarchy Constraints

A cloud administrator needs to establish strict governance controls on a designated 'Production' Folder within the Google Cloud resource hierarchy. The requirements dictate that developers working inside projects under this folder must be prevented from generating long-lived service account JSON keys, and Compute Engine virtual machines must not be assigned public IP addresses. Which TWO configurations should the administrator apply to the 'Production' Folder to meet these security requirements? (Select TWO.)

  1. Enforce the Boolean constraint constraints/iam.disableServiceAccountKeyCreation on the Production folder.Cevap
  2. Configure the List constraint constraints/compute.vmExternalIpAccess to deny all external IP addresses on the Production folder.Cevap
  3. C
    Grant the primitive Owner role (roles/owner) to folder administrators so they can manually remove project-level IAM permissions whenever keys or external IPs are created.
  4. D
    Create IAM Deny policies on child projects to explicitly override and block inherited permissions granted by parent Organization Policies.

Cevap

Enforce the Boolean constraint constraints/iam.disableServiceAccountKeyCreation on the Production folder, and configure the List constraint constraints/compute.vmExternalIpAccess to deny all external IP addresses on the Production folder.
Enforcing the Boolean constraint for disabling service account key creation and setting the List constraint to deny external IP access directly at the folder level ensures that all child projects inherit these rules. This satisfies both security requirements without needing project-by-project manual configuration.

Adım Adım Çözüm

1
Identify the required Organization Policy constraints for the specified governance requirements.
The constraint for disabling service account JSON key creation is constraints/iam.disableServiceAccountKeyCreation, and the constraint for restricting VM public IP assignment is constraints/compute.vmExternalIpAccess.
Organization Policies are used to set centralized constraints on specific GCP resource configurations across the resource hierarchy.
2
Select the target level in the resource hierarchy for policy enforcement.
Apply both policy constraints at the 'Production' Folder node.
Policies applied at a folder node automatically inherit down to all existing and future child projects within that folder.

Anahtar Kavram

Organization Policy Enforcement across Resource Hierarchy Folders
Bu soruyu puanla

Konular

Configuring Organization Policies and Resource Hierarchy Constraints

Bu konudan daha fazla soru