Examkin

Soru

Zorluk: ZorOrganization Policies and Constraints

A global streaming media enterprise uses Google Cloud for its infrastructure. The enterprise security team needs to establish central governance guardrails across the Google Cloud resource hierarchy without causing immediate downtime to running systems. Specifically, they must satisfy two requirements: first, audit and evaluate the impact of prohibiting external IP addresses on Compute Engine instances within the 'Staging' folder before enforcing the block; second, enforce that all new Cloud Storage buckets across the entire organization are created strictly within the 'us-central1' and 'us-east1' regions. Which TWO architecture design choices should you implement to meet these requirements?

  1. Configure the boolean constraint 'constraints/compute.vmExternalIpAccess' using a dry-run policy on the 'Staging' folder.Cevap
  2. Enforce the list constraint 'constraints/gcp.resourceLocations' at the Organization root level with allowed values set to 'in-regions: [us-central1, us-east1]'.Cevap
  3. C
    Create a VPC Service Controls perimeter around the organization root and define egress rules restricting Cloud Storage API calls to specific regional endpoints.
  4. D
    Revoke primitive Editor roles from developer service accounts on the 'Staging' folder and grant the Service Account User role to prevent external IP provisioning.

Cevap

The correct architecture requires configuring the boolean constraint 'constraints/compute.vmExternalIpAccess' in dry-run mode on the 'Staging' folder and enforcing the list constraint 'constraints/gcp.resourceLocations' at the organization root level with allowed values for the designated regions.
The correct solution uses Google Cloud Organization Policies to enforce governance rules across the hierarchy. Applying the boolean constraint for external VM IP access in dry-run mode on the targeted folder enables logging of policy non-compliance without breaking active development workflows. Simultaneously, enforcing the resource location list constraint at the organization root guarantees inherited compliance for resource provisioning locations across all projects.

Adım Adım Çözüm

1
Identify the mechanism for non-disruptive testing of VM external IP restrictions.
Using dry-run organization policies allows security teams to test constraints by generating audit logs upon policy violation without actively denying resource creation.
Dry-run policy evaluation satisfies the requirement to evaluate impact without blocking existing or new staging workloads.
2
Determine the resource hierarchy node and constraint configuration for regional resource restriction.
Organization policies inherit down the resource hierarchy. Applying 'constraints/gcp.resourceLocations' at the Organization root enforces region constraints across all folders and projects.
List constraints with allowed values restricting regions ensure compliance across all Cloud Storage buckets created in the organization.

Anahtar Kavram

Organization Policy Dry-Run Evaluation and Resource Location List Constraints
Bu soruyu puanla

Konular

Organization Policies and Constraints

Bu konudan daha fazla soru