A enterprise compliance team needs to restrict virtual machines from being assigned public IP addresses across a development folder while testing policy impact before enforcing strict blocking. Which TWO actions should a Cloud Architect perform using Google Cloud Organization Policies? (Select TWO)
- Set the `constraints/compute.vmExternalIpAccess` boolean constraint to enforce policy restriction on the targeted folder.Cevap
- Configure the organization policy enforcement mode to Dry-Run to audit potential violations without blocking VM creation.Cevap
- CRevoke the primitive Owner role from project service accounts and assign fine-grained IAM roles instead.
- DDefine a VPC Service Controls service perimeter around the development folder to prevent external IP assignments.
Cevap
To prevent Compute Engine instances from receiving public IP addresses while evaluating impact safely, the architect must apply the `constraints/compute.vmExternalIpAccess` constraint at the target folder level and configure policy enforcement to Dry-Run mode.
Applying the `constraints/compute.vmExternalIpAccess` constraint directly enforces restrictions on external IP provisioning, while setting dry-run mode allows auditing and logging of non-compliant configurations without breaking active workflows.
Adım Adım Çözüm
Anahtar Kavram
Organization Policy Constraints and Dry-Run Enforcement