Examkin

Soru

Zorluk: OrtaConfiguring Organization Policies and Resource Hierarchy Constraints

An enterprise organization requires that all Compute Engine virtual machine instances residing within a folder named 'Production' mandate OS Login for user authentication to disable instance-level SSH keys. Which approach correctly enforces this constraint across the resource hierarchy?

  1. Apply the constraints/compute.requireOsLogin Organization Policy constraint at the 'Production' folder level and set its enforcement to Enforced.Cevap
  2. B
    Grant the Compute Instance Admin IAM role at the 'Production' folder level with a conditional deny expression for instance metadata keys.
  3. C
    Apply the constraints/compute.requireOsLogin Organization Policy constraint separately on each child project, because folder-level policies do not inherit down to project resources.
  4. D
    Assign the primitive Owner role to the Security Operations group on the 'Production' folder to automatically activate OS Login enforcement.

Cevap

Apply the constraints/compute.requireOsLogin Organization Policy constraint at the 'Production' folder level with enforcement enabled.
Applying the boolean constraint `constraints/compute.requireOsLogin` at the folder level and enabling enforcement ensures that all virtual machines created within child projects under the 'Production' folder are mandated to use OS Login, suppressing instance-level SSH key access through inherited resource hierarchy guardrails.

Adım Adım Çözüm

1
Identify the proper mechanism for restricting resource configurations across a resource hierarchy subset.
Recognize that Organization Policy constraints (such as constraints/compute.requireOsLogin) govern resource behaviors, while IAM policies grant permissions.
Organization Policies allow administrators to set programmatic restrictions across organizations, folders, or projects.
2
Determine the optimal resource hierarchy location for policy application.
Target the 'Production' folder level.
Setting the policy at the folder level ensures centralized governance for all current and future child projects in that folder without requiring manual per-project configuration.
3
Verify policy inheritance rules in Google Cloud.
Confirm that folder-level enforcement trickles down to all contained projects.
Resource hierarchy inheritance ensures child nodes inherit parent organization policy constraints unless an explicit override is configured.

Anahtar Kavram

Organization Policy Enforcement and Resource Hierarchy Inheritance
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Configuring Organization Policies and Resource Hierarchy Constraints

Bu konudan daha fazla soru