Examkin

Soru

Zorluk: ZorOrganization Policies and Constraints

A cloud security architect is establishing central governance controls across an enterprise Google Cloud environment. The security policy mandates two key compliance rules for all projects residing under the 'Production' folder: first, cloud resources must only be provisioned within US regions; second, developers must be prevented from creating user-managed service account keys. Which TWO administrative actions should the architect perform to enforce these controls? (Select TWO.)

  1. Apply the `constraints/gcp.resourceLocations` Organization Policy on the 'Production' folder and configure it to allow location values matching `in:us-locations`.Cevap
  2. B
    Grant the primitive Owner role (`roles/owner`) at the folder level to security administrators while revoking compute deployment roles from developers.
  3. Apply the `constraints/iam.disableServiceAccountKeyCreation` Organization Policy on the 'Production' folder and set its enforcement to enabled.Cevap
  4. D
    Configure a VPC Service Controls perimeter around the 'Production' folder and configure an egress policy blocking key management service calls.

Cevap

The correct configuration requires applying two distinct Organization Policies at the folder level: setting `constraints/gcp.resourceLocations` to restrict allowed regions to `in:us-locations`, and enabling `constraints/iam.disableServiceAccountKeyCreation` to block user-managed key creation.
Organization Policies provide centralized constraint management across the resource hierarchy. Applying `constraints/gcp.resourceLocations` configured for `in:us-locations` restricts deployment locations to US regions. Concurrently, enforcing `constraints/iam.disableServiceAccountKeyCreation` prevents service account key generation for all projects under the targeted folder.

Adım Adım Çözüm

1
Identify the appropriate policy mechanism for location restrictions
The `constraints/gcp.resourceLocations` list constraint allows governance teams to define allowed location groups (such as `in:us-locations`) across inherited project hierarchies.
Organization policies provide centralized, declarative rules to restrict resource provisioning parameters regardless of IAM permissions.
2
Identify the appropriate policy mechanism for blocking service account key creation
The boolean constraint `constraints/iam.disableServiceAccountKeyCreation` prevents users from creating external service account keys when enforced.
Restricting long-lived credential creation reduces security risk and forces reliance on short-lived tokens or Workload Identity.
3
Determine the optimal resource hierarchy scope for enforcement
Applying both constraints to the 'Production' folder ensures automatic inheritance across all current and future production projects.
Organization policies inherit down the resource hierarchy from folders to child projects.

Anahtar Kavram

Centralized Governance using Google Cloud Organization Policies and Hierarchy Constraints
Bu soruyu puanla

Konular

Organization Policies and Constraints

Bu konudan daha fazla soru