Examkin

Soru

Zorluk: OrtaOrganization Policies and Constraints

A financial enterprise is establishing security guardrails across its Google Cloud resource hierarchy. The security team requires that all projects under the `Production` folder strictly prevent the creation of service account keys and restrict resource deployments exclusively to European regions. Which TWO Organization Policy constraints should the security team apply at the `Production` folder level to meet these requirements?

  1. Enforce the `iam.disableServiceAccountKeyCreation` boolean constraint at the `Production` folder level.Cevap
  2. Enforce the `gcp.resourceLocations` list constraint with allowed values specified for European regions at the `Production` folder level.Cevap
  3. C
    Assign the `roles/iam.serviceAccountUser` role to developer groups instead of `roles/iam.serviceAccountAdmin` to prevent key generation.
  4. D
    Configure a VPC Service Controls perimeter around the `Production` folder to restrict service account key export and regional resource allocation.

Cevap

The security team must enforce the `iam.disableServiceAccountKeyCreation` constraint to block service account key creation and enforce the `gcp.resourceLocations` constraint with an allowed list of European regions.
The correct options involve applying the `iam.disableServiceAccountKeyCreation` boolean constraint and the `gcp.resourceLocations` list constraint. Organization Policies allow administrators to set organization-wide or folder-wide guardrails that inherit down the resource hierarchy. `iam.disableServiceAccountKeyCreation` explicitly prevents users from generating service account keys, while `gcp.resourceLocations` limits resource creation to specific geographical locations.

Adım Adım Çözüm

1
Identify the requirement to prevent service account key creation across inherited projects.
Select the `iam.disableServiceAccountKeyCreation` boolean constraint.
Organization Policies provide programmatic constraints to disable service account key creation centrally at the folder level.
2
Identify the requirement to restrict deployment geographic locations.
Select the `gcp.resourceLocations` list constraint configured for European regions.
The `gcp.resourceLocations` list constraint defines explicit location boundaries for newly created resources across supported Google Cloud services.

Anahtar Kavram

Centralized Governance using Boolean and List Organization Policy Constraints
Bu soruyu puanla

Konular

Organization Policies and Constraints

Bu konudan daha fazla soru