A enterprise architecture team is implementing centralized governance guardrails across their Google Cloud resource hierarchy. They must ensure that development teams cannot allocate external IP addresses to virtual machine instances within the Development folder. Additionally, they must restrict API access within the Analytics folder so that projects can only enable approved Google Cloud services (such as Cloud Storage and BigQuery). Which TWO configuration steps should the cloud architect execute using Organization Policies to achieve these requirements? (Select TWO)
- Apply the `constraints/compute.vmExternalIpAccess` boolean constraint on the Development folder to deny public IP assignment to compute instances.Cevap
- BAssign primitive Viewer roles to developers at the Development folder level to revoke their permission to create external IP addresses.
- Configure the `constraints/gcp.restrictServiceUsage` list constraint on the Analytics folder with an `allowed_values` list containing only the approved service identifiers.Cevap
- DDefine a VPC Service Controls perimeter around the Analytics folder projects with egress rules blocking unauthorized API access.
Cevap
Enforce the `constraints/compute.vmExternalIpAccess` constraint on the Development folder to block external IP creation, and apply the `constraints/gcp.restrictServiceUsage` list constraint on the Analytics folder specifying the allowed service APIs.
Organization Policies provide centralized governance controls across Google Cloud folders and organizations. The `compute.vmExternalIpAccess` constraint explicitly restricts external IP assignment on Compute Engine VMs, while `gcp.restrictServiceUsage` specifies an allowlist of service APIs that projects under the folder can enable.
Adım Adım Çözüm
Anahtar Kavram
Organization Policies enforce central programmatic guardrails over resource configurations and API usage across the Google Cloud resource hierarchy.