A cloud security administrator needs to prevent Compute Engine VM instances from being assigned external IP addresses across all projects contained within the 'Engineering' folder. Additionally, one specific testing project inside that folder requires external IPs for synthetic user testing. Which two steps must the administrator take to configure this resource hierarchy constraint correctly?
- Apply the organization policy constraint restricting external IP access at the 'Engineering' folder level.Cevap
- BGrant the Organization Policy Administrator role to the Compute Engine default service account to automatically enforce the network rule.
- Override the inherited organization policy on the specific testing project node to allow external IP address assignment.Cevap
- DCreate an IAM Deny policy at the folder level and rely on IAM inheritance to prevent projects from requesting external IP addresses.
Cevap
To enforce this configuration, the administrator must apply the organization policy constraint at the folder level to cover all child projects by default, and then override the inherited policy directly on the testing project node to permit external IPs.
Applying the organization policy constraint at the folder level ensures that all projects within the 'Engineering' folder inherit the external IP restriction. To grant the necessary exception, overriding the policy at the specific testing project node allows external IP allocation without breaking compliance for the rest of the folder.
Adım Adım Çözüm
Anahtar Kavram
GCP Organization Policies allow central governance across the resource hierarchy (Organization -> Folder -> Project), where inherited policies can be overridden at lower nodes to accommodate specific project exceptions.
Tahmini Süre:1m 30s