Examkin

Soru

Zorluk: ZorOrganization Policies and Constraints

An enterprise healthcare provider structures its Google Cloud resource hierarchy into a parent folder named 'Clinical-Data' containing child folders 'Production' and 'Staging'. The governance committee mandates that no Compute Engine virtual machines in any project under 'Clinical-Data' are permitted to acquire external IP addresses, while ensuring that project owners in 'Staging' cannot override this restriction. Furthermore, the security team wants to audit and log potential violations across new projects without immediately blocking deployment pipelines during an initial 30-day evaluation phase. Which architectural strategy meets these governance and operational requirements?

  1. Apply the boolean constraint `constraints/compute.vmExternalIpAccess` at the 'Clinical-Data' folder level with enforcement mode set to dry-run, and ensure project administrators are not granted the Organization Policy Admin role.Cevap
  2. B
    Grant primitive Owner roles to project administrators in the 'Staging' folder while applying explicit IAM deny policy bindings at the project level to restrict public IP allocation.
  3. C
    Configure a VPC Service Controls perimeter encompassing the 'Clinical-Data' folder with egress rules configured to block external IP allocation across all subnets.
  4. D
    Assign the Service Account Admin role to project leads in 'Staging' and configure IAM conditions on compute service accounts to restrict external IP bindings.

Cevap

The correct strategy is to enforce the `constraints/compute.vmExternalIpAccess` Organization Policy constraint at the parent folder level in dry-run mode while withholding Organization Policy Administrator permissions from project owners.
Applying the `constraints/compute.vmExternalIpAccess` boolean constraint at the parent folder level ensures that all current and future child projects in both Production and Staging inherit the policy guardrail. Configuring the enforcement mode as dry-run enables the security team to log all non-compliant attempts without impacting active deployment pipelines. Restricting Organization Policy Administrator permissions prevents project-level administrators from modifying or overriding the constraint.

Adım Adım Çözüm

1
Determine the resource hierarchy node for policy placement.
Applying the constraint at the 'Clinical-Data' parent folder ensures child folders ('Production' and 'Staging') inherit the policy restriction automatically.
Hierarchical inheritance ensures consistent enforcement without configuring each project individually.
2
Select the appropriate constraint type and evaluation mode.
Use the boolean constraint `constraints/compute.vmExternalIpAccess` in dry-run mode.
Dry-run mode logs violations to Cloud Audit Logs for inspection during the 30-day trial without breaking existing deployment scripts.
3
Verify access control permissions to prevent policy overrides.
Restrict the `roles/orgpolicy.policyAdmin` role to central governance administrators only.
Project owners without this role cannot override or disable inherited organization policies.

Anahtar Kavram

Organization Policy inheritance, boolean constraints, dry-run evaluation mode, and IAM role separation for central governance.
Bu soruyu puanla

Konular

Organization Policies and Constraints

Bu konudan daha fazla soru