Examkin

Soru

Zorluk: OrtaOrganization Policies and Constraints

A financial enterprise is updating its cloud governance posture across its Google Cloud resource hierarchy. The lead security architect needs to enforce two enterprise-wide governance requirements across all projects under the Production folder:

1. Prevent cloud engineers from generating long-lived service account JSON keys.
2. Prevent Compute Engine virtual machines from being assigned external public IP addresses.

Which TWO Organization Policy constraints must the architect enforce at the Production folder level to satisfy these compliance requirements? (Select TWO.)

  1. Enforce constraints/iam.disableServiceAccountKeyCreationCevap
  2. Enforce constraints/compute.vmExternalIpAccess set to Deny AllCevap
  3. C
    Assign primitive IAM Viewer roles to developers and revoke Service Account Admin permissions across the folder
  4. D
    Configure a VPC Service Controls perimeter around the Production folder and block all egress traffic to external IP addresses

Cevap

The correct options are enforcing constraints/iam.disableServiceAccountKeyCreation and enforcing constraints/compute.vmExternalIpAccess set to Deny All at the folder level.
Enforcing `constraints/iam.disableServiceAccountKeyCreation` prevents users from creating new service account keys within the target hierarchy. Enforcing `constraints/compute.vmExternalIpAccess` with a deny policy blocks VM instances from being configured with external IP addresses. Together, these two Organization Policies directly fulfill both security governance mandates.

Adım Adım Çözüm

1
Identify the requirement to disable long-lived service account JSON keys across the folder hierarchy.
Select the boolean organization policy constraint `constraints/iam.disableServiceAccountKeyCreation`.
Organization policies enforce centralized resource constraints across inherited folders and projects.
2
Identify the requirement to restrict Compute Engine instances from receiving external public IP addresses.
Select the list organization policy constraint `constraints/compute.vmExternalIpAccess` and set it to block/deny external IP attachment.
This constraint specifically restricts external IP configuration on VM network interfaces.

Anahtar Kavram

Organization Policies for IAM and Compute Security Controls
Bu soruyu puanla

Konular

Organization Policies and Constraints

Bu konudan daha fazla soru