Examkin

Soru

Zorluk: Çok zorOrganization Policies and Constraints

A multinational financial institution is configuring automated compliance guardrails across its Google Cloud resource hierarchy. The cloud architecture team must enforce two governance mandates:
1. Prevent the creation of user-managed service account keys across all projects in the organization, while granting an exception for a legacy payment integration project residing in a dedicated folder that requires JSON keys for on-premises authentication.
2. Restrict resource deployment locations to European Union regions (in:eu−locationsin:eu-locations) across the entire hierarchy, while allowing a specialized high-performance analytics project to deploy compute resources in in:us−central1−locationsin:us-central1-locations.

Which TWO architectural configurations should the cloud architect implement to meet these governance requirements?

  1. Enforce the boolean constraint `constraints/iam.disableServiceAccountKeyCreation` at the Organization root node, and set an explicit enforcement rule of `enforced: false` on the legacy payment integration project to override inheritance.Cevap
  2. Apply the list constraint `constraints/gcp.resourceLocations` with `allowed_values = ["in:eu-locations"]` at the Organization root, and configure a policy rule on the analytics project with `allowed_values = ["in:us-central1-locations"]` while overriding parent rules.Cevap
  3. C
    Assign the primitive Owner role to security administrators at the Organization root node with IAM Conditions to deny service account key creation across all child projects.
  4. D
    Establish a VPC Service Controls perimeter around the organization root and construct data egress rules to block service account key API calls and out-of-region API endpoints.
  5. E
    Grant developers on the legacy payment integration project the Service Account Admin role (`roles/iam.serviceAccountAdmin`) so their identity bypasses organization policy constraint evaluation.

Cevap

The architect must enforce the service account key creation boolean constraint at the Organization root with an explicit non-enforced override on the legacy project, and set the resource location list constraint to EU locations globally while overriding the rule on the analytics project to allow US Central locations.
Organization policies allow central security teams to restrict resource configurations hierarchically. Boolean constraints such as service account key creation restriction can be enforced at the root and selectively set to non-enforced on sub-nodes. List constraints such as resource locations allow defining allowed values (e.g., EU regions) at the root while replacing parent rules on sub-projects to permit specific alternative locations.

Adım Adım Çözüm

1
Analyze requirement for credential security governance and exception handling.
Identified `constraints/iam.disableServiceAccountKeyCreation` as the appropriate boolean constraint.
Boolean constraints inherit down the resource hierarchy. Applying enforcement at the Organization root secures all child nodes, while setting `enforced: false` on a specific project child node overrides the inherited policy for authorized exceptions.
2
Analyze location restriction governance and project-level exception requirement.
Identified `constraints/gcp.resourceLocations` as the required list constraint.
List constraints support value matching groups such as `in:eu−locationsin:eu-locations`. Configuring allowed values at the root sets the baseline, while child nodes can override parent rules (`inheritFromParent: false`) to define specific allowed values such as `in:us−central1−locationsin:us-central1-locations`.
3
Evaluate invalid governance approaches.
Rejected options relying on primitive IAM roles, VPC Service Controls exfiltration boundaries, or elevated service account permissions.
Organization Policies evaluate resource configuration limits independently of IAM permission grants or network perimeter definitions.

Anahtar Kavram

Organization Policy Resource Hierarchy Inheritance & Overrides
Bu soruyu puanla

Konular

Organization Policies and Constraints

Bu konudan daha fazla soru