An enterprise is deploying a centralized analytics lakehouse on Google Cloud to process data across multiple business units. As the lead data engineer, you must establish an enterprise-level security baseline using Organization Policy constraints applied at the root organization node. The baseline must satisfy three security requirements: Enforce strict data sovereignty by restricting resource provisioning solely to approved geographic regions. Mitigate credential exfiltration risks by blocking the generation of downloadable, long-lived service account keys. Prevent accidental exposure of sensitive datasets by blocking public and anonymous internet access across all cloud storage buckets. Which set of organization policy constraints should you enforce at the organization level to meet these requirements?

Enforce `constraints/gcp.resourceLocations`, `constraints/iam.disableServiceAccountKeyCreation`, and `constraints/storage.publicAccessPrevention` across the organization hierarchy.: ### What the Solution Is Google Cloud **Organization Policies** provide centralized governance across the resource hierarchy (Organization, Folders, and Projects). They enforce guardrails and constraints on resources regardless of the Cloud IAM roles granted to individual developers. ### How It Meets the Requirements - **Strict Data Sovereignty (`constraints/gcp.resourceLocations`)**: This list constraint restricts the physical locations where new resources across supported Google Cloud services (such as BigQuery, Dataproc, Cloud Spanner, and Cloud Storage) can be created, ensuring full compliance with corporate data residency policies. - **Disabling Service Account Keys (`constraints/iam.disableServiceAccountKeyCreation`)**: This boolean constraint prevents users and automated processes from creating external, user-managed private keys (`.json` or `.p12`) for service accounts, thereby eliminating the attack vector of leaked credentials. - **Blocking Public Access (`constraints/storage.publicAccessPrevention`)**: This boolean constraint enforces Public Access Prevention on Cloud Storage buckets, denying all operations that grant public access permissions (such as `allUsers` and `allAuthenticatedUsers`) via IAM policies or ACLs. ### Key Advantages - **Hierarchical Inheritance**: Applying these constraints at the organization node automatically propagates protection down to all current and future folders and projects. - **Preventative Guardrails**: Prevents misconfigurations before resources are created, eliminating human error. - **Compliance and Audit Readiness**: Centralizes governance enforcement, simplifying regulatory reporting. - **Zero Friction with Native Identity**: Enforces modern security patterns such as workload identity federation and short-lived credentials instead of static service account keys. ### Why This Is Optimal This approach directly targets the exact built-in organization policy constraints designed to enforce geographic boundaries, credential protection, and storage exposure prevention natively without relying on post-deployment scripts or manual reviews.

Enterprise Org Policy Baseline Data Security | professional-cloud-data-engineer

Enterprise Org Policy Baseline Data Security

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise is deploying a centralized analytics lakehouse on Google Cloud to process data across multiple business units. As the lead data engineer, you must establish an enterprise-level security baseline using Organization Policy constraints applied at the root organization node.

The baseline must satisfy three security requirements:

Enforce strict data sovereignty by restricting resource provisioning solely to approved geographic regions.
Mitigate credential exfiltration risks by blocking the generation of downloadable, long-lived service account keys.
Prevent accidental exposure of sensitive datasets by blocking public and anonymous internet access across all cloud storage buckets.

Which set of organization policy constraints should you enforce at the organization level to meet these requirements?

Enforce constraints/gcp.resourceLocations, constraints/iam.disableServiceAccountKeyCreation, and constraints/storage.publicAccessPrevention across the organization hierarchy.

Apply IAM Deny policies targeting resourcemanager.projects.create, iam.serviceAccountKeys.create, and storage.buckets.setIamPolicy on all developer groups.

Implement custom Secret Manager policies with custom.ensureVersionDestroyTTLAtLeast30hours and attach VPC Service Controls perimeters around each individual project.

Configure constraints/compute.vmExternalIpAccess, constraints/iam.allowServiceAccountCredentialLifetime, and constraints/storage.uniformBucketLevelAccess at the organization node.

Professional Cloud Data Engineer

Enterprise Org Policy Baseline Data Security

Related questions