Examkin

Soru

Zorluk: KolayOrganization Policies and Constraints

An enterprise security architect wants to prevent developers from creating service account keys and ensure that Compute Engine resources can only be deployed in specific approved Google Cloud regions across all projects contained within the `Production` folder. Which TWO Organization Policy constraints should be configured to satisfy these governance requirements? (Select TWO.)

  1. Enforce `constraints/iam.disableServiceAccountKeyCreation` at the `Production` folder level.Cevap
  2. Enforce `constraints/gcp.resourceLocations` with an allowed locations list at the `Production` folder level.Cevap
  3. C
    Grant the primitive Viewer role (`roles/viewer`) to developer identities at the `Production` folder level.
  4. D
    Configure a VPC Service Controls perimeter encompassing the `Production` folder to restrict resource creation and API access.

Cevap

The correct policy constraints to enforce at the `Production` folder level are `constraints/iam.disableServiceAccountKeyCreation` to block key creation and `constraints/gcp.resourceLocations` to restrict regional deployments.
Enforcing `constraints/iam.disableServiceAccountKeyCreation` directly disables service account key creation, and enforcing `constraints/gcp.resourceLocations` limits infrastructure deployment to specified regions. Configured at the folder level, these constraints automatically govern all child projects.

Adım Adım Çözüm

1
Identify the requirement for disabling service account key creation.
Recognize that `constraints/iam.disableServiceAccountKeyCreation` is the built-in Organization Policy constraint designed specifically to block service account key generation.
Organization policies provide central declarative control over resource behaviors across the hierarchy.
2
Identify the requirement for restricting geographic resource deployment.
Recognize that `constraints/gcp.resourceLocations` allows administrators to specify an allowlist of Google Cloud regions for resource creation.
This constraint restricts resource provisioning to approved regions to maintain data sovereignty and regulatory compliance.
3
Determine the appropriate scope for enforcement.
Apply both constraints at the `Production` folder level so all nested child projects inherit the governance rules.
Applying policies at the folder level ensures uniform inheritance across all current and future projects under that folder.

Anahtar Kavram

Organization Policy Constraints for IAM Security and Location Restrictions
Bu soruyu puanla

Konular

Organization Policies and Constraints

Bu konudan daha fazla soru