Examkin

Soru

Zorluk: OrtaOrganization Policies and Constraints

A global healthcare enterprise is migrating its patient image processing application to Google Cloud. To satisfy strict data privacy regulations and governance guardrails across all projects contained within the Healthcare-Workloads folder, the cloud security team must enforce two specific governance controls:

1. Compute Engine virtual machine instances must not be allocated external/public IP addresses.
2. Google Cloud resources must be restricted to deployment exclusively within European locations (eu-west1 and eu-west3).

Which TWO Organization Policy constraints should the cloud architect apply to the Healthcare-Workloads folder? (Select TWO.)

  1. Enforce the `constraints/compute.vmExternalIpAccess` boolean constraint with an empty allowlist.Cevap
  2. Enforce the `constraints/gcp.resourceLocations` list constraint configured to allow `in:eu-west1-locations` and `in:eu-west3-locations`.Cevap
  3. C
    Configure a VPC Service Controls security perimeter around the folder to block external network egress traffic to public IP ranges.
  4. D
    Assign the `roles/compute.networkAdmin` IAM role at the folder level to restrict users from attaching external IP addresses.

Cevap

The architect must enforce the `compute.vmExternalIpAccess` constraint to restrict public IP allocation and the `gcp.resourceLocations` constraint to limit resource creation to specified European regions.
Applying Organization Policy constraints at the folder level ensures inherited, immutable guardrails across all contained projects. The `compute.vmExternalIpAccess` constraint blocks public IP assignments on virtual machines, and the `gcp.resourceLocations` constraint restricts resource provisioning strictly to the specified European regions.

Adım Adım Çözüm

1
Identify the mechanism for restricting external IP addresses on Compute Engine VMs across a resource hierarchy.
The Organization Policy constraint `constraints/compute.vmExternalIpAccess` governs which VM instances can have external IP addresses. Applying an empty allowlist denies external IP allocation for all instances in the target folder.
Organization policies allow centralized control over infrastructure configuration options across all child projects under a folder.
2
Identify the mechanism for enforcing data sovereignty and geographic location restrictions for GCP resource creation.
The `constraints/gcp.resourceLocations` list constraint restricts the physical regions where resources can be created. Configuring it with `in:eu-west1-locations` and `in:eu-west3-locations` fulfills the European location requirement.
Resource location constraints enforce compliance guardrails across supported GCP services at the resource hierarchy level.

Anahtar Kavram

Centralized Governance using Organization Policy Constraints for VM Networking and Resource Placement
Bu soruyu puanla

Konular

Organization Policies and Constraints

Bu konudan daha fazla soru