Examkin

Soru

Zorluk: ZorConfiguring Organization Policies and Resource Hierarchy Constraints

An organization administrator needs to enforce security controls on Google Cloud Compute Engine resources across a multi-tier resource hierarchy consisting of an Organization node, a 'Production' folder, and several project nodes. The organization policy currently restricts external IP addresses on Compute Engine instances at the Organization node using `constraints/compute.vmExternalIpAccess`. The administrator wants to allow external IP access exclusively for virtual machines within a single designated project under the 'Production' folder, while ensuring that interactive serial port access (`constraints/compute.disableGlobalSerialPortAccess`) remains blocked across all projects in the organization. Which TWO policy management actions must the administrator perform to achieve these requirements?

  1. Override the inherited list constraint on the designated project by setting `constraints/compute.vmExternalIpAccess` to allow external IP access for that specific project.Cevap
  2. Configure the boolean constraint `constraints/compute.disableGlobalSerialPortAccess` to Enforce at the Organization root level.Cevap
  3. C
    Grant the Security Admin role (`roles/iam.securityAdmin`) on the designated project to bypass the inherited `constraints/compute.vmExternalIpAccess` restriction.
  4. D
    Revoke the Project Owner role from project members to automatically clear inherited boolean policy constraints from the Organization node.

Cevap

To achieve the security policy requirements, the administrator must override the list constraint `constraints/compute.vmExternalIpAccess` on the designated project to allow external IP access, and enforce the boolean constraint `constraints/compute.disableGlobalSerialPortAccess` at the Organization root node so it inherits down to all child resources.
Organization policies follow resource hierarchy inheritance rules. Setting a list constraint override at the project level allows specific exceptions to organization-wide restrictions, while setting a boolean constraint at the root organization node ensures default enforcement across all descendant folders and projects. Neither IAM role assignments nor role revocations alter organization policy evaluation.

Adım Adım Çözüm

1
Analyze policy inheritance for list constraints.
List constraints set at parent nodes apply down the hierarchy by default, but can be overridden at a child node by defining project-specific allowed lists.
Project-level policy overrides allow explicit exceptions to organization-wide list constraints.
2
Analyze policy inheritance for boolean constraints.
Enforcing a boolean constraint at the Organization root node sets the policy baseline across all descendant folders and projects.
Child nodes inherit the enforced state of boolean policy constraints unless a lower-level node explicitly alters the enforcement state.
3
Evaluate distractor choices regarding IAM roles and organization policy interactions.
IAM roles manage access control for principals, whereas Organization Policies establish guardrails on resources. Assigning or revoking IAM roles cannot alter or bypass Organization Policy constraints.
Organization Policy guardrails evaluate independently of IAM permissions.

Anahtar Kavram

Organization Policy Inheritance and Enforcement across the GCP Resource Hierarchy
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Configuring Organization Policies and Resource Hierarchy Constraints

Bu konudan daha fazla soru