Examkin

Soru

Zorluk: OrtaOrganization Policies and Constraints

An enterprise software organization is establishing centralized security guardrails across its Google Cloud resource hierarchy. The cloud security architect must enforce two specific governance mandates across all projects within a target folder:

1. Prevent developers from generating exportable service account keys to mitigate credential leakage risks.
2. Restrict the deployment of all Google Cloud location-based resources exclusively to the `us-central1` and `us-east1` regions.

Which TWO Organization Policy constraints should be configured at the target folder level to satisfy these mandates?

  1. Enforce the boolean constraint `constraints/iam.disableServiceAccountKeyCreation` by setting its policy state to Enforced.Cevap
  2. Configure the list constraint `constraints/gcp.resourceLocations` with an allowed list containing `in:us-central1-locations` and `in:us-east1-locations`.Cevap
  3. C
    Grant the primitive `roles/owner` role at the folder level and append IAM conditions to filter service account key generation and regional deployment endpoints.
  4. D
    Define a VPC Service Controls perimeter around the folder and configure ingress rules to block cross-region API access and key downloads.

Cevap

The correct configurations are enforcing the boolean constraint `constraints/iam.disableServiceAccountKeyCreation` and setting the list constraint `constraints/gcp.resourceLocations` to allow `in:us-central1-locations` and `in:us-east1-locations`.
The correct configuration combines enforcing `constraints/iam.disableServiceAccountKeyCreation` to disable service account key creation and configuring `constraints/gcp.resourceLocations` to restrict GCP resource deployment to specified regions (`us-central1` and `us-east1`).

Adım Adım Çözüm

1
Identify the constraint type for service account key prevention.
The constraint `constraints/iam.disableServiceAccountKeyCreation` is a boolean Organization Policy constraint that prevents creation of service account keys when set to Enforced.
Organization Policies provide centralized governance guardrails across the resource hierarchy that IAM permissions alone cannot enforce.
2
Identify the constraint type for geographic location restrictions.
The constraint `constraints/gcp.resourceLocations` is a list constraint that limits where location-based GCP resources can be provisioned.
Specifying value groups such as `in:us-central1-locations` ensures data sovereignty and regional resource compliance across child projects.

Anahtar Kavram

Organization Policies and Constraints
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Organization Policies and Constraints

Bu konudan daha fazla soru