Examkin

Soru

Zorluk: ZorOrganization Policies and Constraints

A cloud governance team manages a Google Cloud resource hierarchy structured by business units into separate folders. A new security mandate requires that no Compute Engine virtual machine (VM) instances created within the 'FinTech' folder be assigned external IP addresses. However, one specific migration project inside the 'FinTech' folder requires external IP access for legacy integration testing during a 30-day transition period. What is the Google-recommended architectural approach to enforce this policy while supporting the transition project?

  1. Apply the Organization Policy constraint `constraints/compute.vmExternalIpAccess` at the 'FinTech' folder level to deny external IPs, and configure a project-level organization policy override on the legacy project to allow external IP allocation.Cevap
  2. B
    Revoke custom Compute Engine permissions across the 'FinTech' folder and assign the primitive Owner role to project administrators, relying on IAM policy bindings to prevent external IP attachments on instances.
  3. C
    Construct a VPC Service Controls perimeter around the 'FinTech' folder to block public IP assignment, and define a perimeter egress rule for the legacy project to permit external connectivity.
  4. D
    Grant the Service Account User role (`roles/iam.serviceAccountUser`) across the 'FinTech' folder to restrict network interface creation, while granting the Service Account Admin role on the legacy project.

Cevap

Enforce the Organization Policy constraint `constraints/compute.vmExternalIpAccess` at the 'FinTech' folder level to deny external IP addresses, and configure an organization policy override at the legacy project level to permit external IP allocation.
Organization Policies enforce centralized resource configuration guardrails across the resource hierarchy. Applying the `constraints/compute.vmExternalIpAccess` constraint at the folder level guarantees inherited enforcement across all member projects. Explicitly setting a policy override at the child project level permits fine-grained compliance exceptions for specific projects without modifying the parent folder policy.

Adım Adım Çözüm

1
Identify the proper Google Cloud governance tool for resource configuration guardrails.
Organization Policies (specifically `constraints/compute.vmExternalIpAccess`) regulate resource creation constraints independently of IAM access.
Organization policies act as centralized guardrails governing resource configuration across the hierarchy.
2
Determine the resource hierarchy placement for the baseline security policy.
Enforce the constraint at the 'FinTech' folder level.
Applying the constraint at the folder level ensures that all existing and future child projects inherit the external IP restriction by default.
3
Configure the exception mechanism for the legacy migration project.
Apply a project-level Organization Policy override on the specific legacy project.
Google Cloud Organization Policy hierarchy allows child nodes to override inherited policies, enabling temporary, localized exceptions without compromising the parent folder guardrails.

Anahtar Kavram

Organization Policy Resource Hierarchy Inheritance and Project Overrides
Bu soruyu puanla

Konular

Organization Policies and Constraints

Bu konudan daha fazla soru