Examkin

Soru

Zorluk: ZorOrganization Policies and Constraints

An enterprise logistics corporation is deploying a new fleet management platform across multiple Google Cloud projects organized under a parent folder named `Fleet-Ops`. The compliance team mandates two strict governance guardrails: (1) prevent users from generating external service account keys to mitigate credential leakage risks, and (2) restrict all infrastructure deployment strictly to European regions (`europe-west1` and `europe-west4`). Additionally, the team must evaluate the operational impact of the key creation restriction on existing pipelines prior to active blocking. Which TWO actions should the security architect take to satisfy these governance requirements using Google Cloud Organization Policies?

  1. Apply the boolean constraint `iam.disableServiceAccountKeyCreation` at the `Fleet-Ops` folder level with a dry-run policy spec to monitor violations in Cloud Logging before enforcing active blocking.Cevap
  2. Apply the list constraint `gcp.resourceLocations` at the `Fleet-Ops` folder level, configuring the allowed values to include `in:europe-west1-locations` and `in:europe-west4-locations`.Cevap
  3. C
    Grant the primitive `roles/viewer` IAM role at the `Fleet-Ops` folder level to developer service accounts to prevent them from creating service account keys and provisioning resources in unauthorized regions.
  4. D
    Create a VPC Service Controls security perimeter encompassing all projects under the `Fleet-Ops` folder to restrict resource locations and block service account key generation.

Cevap

Configure an Organization Policy with a dry-run spec for the boolean constraint iam.disableServiceAccountKeyCreation at the Fleet-Ops folder level, and configure an Organization Policy with the list constraint gcp.resourceLocations allowing in:europe-west1-locations and in:europe-west4-locations at the Fleet-Ops folder level.
The solution requires applying two distinct Google Cloud Organization Policies at the `Fleet-Ops` folder level. First, applying the `iam.disableServiceAccountKeyCreation` boolean constraint with a dry-run policy spec allows security administrators to monitor logs in Cloud Logging for non-compliant service account key creation attempts without breaking current CI/CD pipelines. Second, enforcing the `gcp.resourceLocations` list constraint with explicit region group values restricts resource provisioning across all child projects strictly to `europe-west1` and `europe-west4`.

Adım Adım Çözüm

1
Identify the governance requirements for service account key restriction and dry-run evaluation.
Selected the boolean Organization Policy constraint `iam.disableServiceAccountKeyCreation` applied at the `Fleet-Ops` folder level with a dry-run configuration.
Dry-run policy enforcement logs violations to Cloud Logging without blocking actions, fulfilling the requirement to test impact on existing pipelines.
2
Identify the governance requirements for regional resource location boundaries.
Selected the list Organization Policy constraint `gcp.resourceLocations` configured with `in:europe-west1-locations` and `in:europe-west4-locations` at the `Fleet-Ops` folder level.
List constraints at the folder level prevent any underlying project from deploying resources outside the specified regional location groups.

Anahtar Kavram

Google Cloud Organization Policies enforcement, dry-run testing, and resource hierarchy inheritance
Bu soruyu puanla

Konular

Organization Policies and Constraints

Bu konudan daha fazla soru