Examkin

Soru

Zorluk: ZorOrganization Policies and Constraints

A multinational financial services enterprise manages its Google Cloud environment using a folder hierarchy divided by business units. The security compliance team requires two central guardrails across the entire `Retail-Banking` folder structure: (1) block any Compute Engine virtual machine from being provisioned with an external IP address, and (2) test a restriction against creating service account keys across the organization without breaking existing automated continuous integration pipelines. Which TWO architectural actions should the lead Cloud Architect execute using Google Cloud Organization Policies?

  1. Apply an Organization Policy at the `Retail-Banking` folder level setting the `constraints/compute.vmExternalIpAccess` constraint to Deny All.Cevap
  2. Configure the `constraints/iam.disableServiceAccountKeyCreation` Organization Policy constraint at the Organization root level with Enforcement set to Dry-Run.Cevap
  3. C
    Assign primitive IAM Viewer roles to deployment service accounts at the folder level to prevent them from allocating external IP addresses and creating service account keys.
  4. D
    Construct a VPC Service Controls perimeter encompassing the `Retail-Banking` folder to block public IP assignment and prevent service account key exfiltration.

Cevap

The Cloud Architect must apply the `constraints/compute.vmExternalIpAccess` policy set to Deny All at the target folder level, and set the `constraints/iam.disableServiceAccountKeyCreation` policy to Dry-Run at the Organization root level.
The correct responses specify using Google Cloud Organization Policies appropriately: enforcing `constraints/compute.vmExternalIpAccess` at the folder node directly prevents public IP attachment on Compute Engine instances, while configuring `constraints/iam.disableServiceAccountKeyCreation` in dry-run mode at the organization root tests policy compliance against live CI pipelines without causing immediate workflow failures.

Adım Adım Çözüm

1
Identify the constraint required for external IP prevention and target scope.
The `constraints/compute.vmExternalIpAccess` boolean constraint enforced at the `Retail-Banking` folder level restricts VM public IP creation across all child projects.
Organization policies inherit down the resource hierarchy, making folder-level enforcement effective for all scoped projects.
2
Identify the strategy to audit service account key creation restrictions without breaking existing pipelines.
Deploying `constraints/iam.disableServiceAccountKeyCreation` in Dry-Run mode at the organization root level emits audit logs upon key creation attempts while allowing execution.
Dry-run mode enables security teams to evaluate the operational impact on CI/CD pipelines before hard enforcement.

Anahtar Kavram

Organization Policies and Constraints
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Organization Policies and Constraints

Bu konudan daha fazla soru