Your enterprise organization is bootstrapping its landing zone across multiple Google Cloud folders and projects. As a DevOps engineer, you are tasked with defining baseline preventative controls at the organization node to establish security guardrails across the entire resource hierarchy while still allowing folder- or project-level exceptions where strictly necessary. Your implementation must satisfy the following requirements: Prevent Compute Engine virtual machine (VM) instances from acquiring external IPv4 addresses. Prevent newly created projects from automatically provisioning a default VPC network and its default firewall rules. Prevent Cloud SQL database instances from having public IP addresses assigned. Which set of organization policy constraints should you configure and enforce at the organization node?

Enforce the `compute.vmExternalIpAccess` constraint with a policy denying all external IP addresses, enforce the `compute.skipDefaultNetworkCreation` boolean constraint set to `true`, and enforce the `sql.restrictPublicIp` boolean constraint set to `true` at the organization node.: ### What the Organization Policy Constraints Are The **Organization Policy Service** provides centralized, programmatic guardrails that govern resource configurations across an entire Google Cloud resource hierarchy. Applying managed constraints at the **organization node** ensures that preventative security baselines automatically cascade down to all child folders, projects, and resources via inheritance, even restricting users with privileged project-level IAM roles. ### How It Meets the Requirements - **Preventing external IP addresses on VMs**: Enforcing `compute.vmExternalIpAccess` with a list policy configured to deny all external IP values (or an empty allowlist) blocks Compute Engine instances from being assigned public IPv4 addresses upon creation or network interface update. - **Disabling default VPC creation**: Enforcing the boolean constraint `compute.skipDefaultNetworkCreation` ensures that when the Compute Engine API is activated in newly created projects, Google Cloud skips the generation of the default VPC network and its default firewall rules. - **Restricting Cloud SQL public IPs**: Enforcing the boolean constraint `sql.restrictPublicIp` blocks the assignment of public IP addresses on Cloud SQL database instances, requiring workloads to leverage private IP networking or authorized proxy configurations. ### Key Advantages and Capabilities - **Hierarchical Governance**: Policies applied at the organization root automatically cover all descendants while allowing controlled granular overrides at folder or project levels when exceptions are justified. - **Preventative Guardrails**: Blocks non-compliant resource creation at API invocation time rather than relying on reactive detection and remediation. - **Separation of Concerns**: Decouples organization-wide compliance enforcement from project-level developer administration. - **Immutable Baselines**: Ensures standard networking security baselines without requiring custom continuous integration policy scripts for every project. ### Why This Is Optimal Leveraging Google-managed organization policy constraints (`compute.vmExternalIpAccess`, `compute.skipDefaultNetworkCreation`, and `sql.restrictPublicIp`) is the native, platform-recommended mechanism to establish strict infrastructure configuration guardrails across the organization resource hierarchy.

Org Policy Constraints Vm Ip Sql Vpc | Professional Cloud DevOps Engineer

Org Policy Constraints Vm Ip Sql Vpc

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

Your enterprise organization is bootstrapping its landing zone across multiple Google Cloud folders and projects. As a DevOps engineer, you are tasked with defining baseline preventative controls at the organization node to establish security guardrails across the entire resource hierarchy while still allowing folder- or project-level exceptions where strictly necessary.

Your implementation must satisfy the following requirements:

Prevent Compute Engine virtual machine (VM) instances from acquiring external IPv4 addresses.
Prevent newly created projects from automatically provisioning a default VPC network and its default firewall rules.
Prevent Cloud SQL database instances from having public IP addresses assigned.

Which set of organization policy constraints should you configure and enforce at the organization node?

Apply a hierarchical firewall policy denying all egress to 0.0.0.0/0 at the organization root and implement IAM Deny policies targeting compute.instances.create and sql.instances.create across all folders.

Create custom CEL constraints on compute.googleapis.com/Instance and sqladmin.googleapis.com/Instance and enforce them individually on each project without configuring policies at the organization root.

Enforce the compute.vmExternalIpAccess constraint with a policy denying all external IP addresses, enforce the compute.skipDefaultNetworkCreation boolean constraint set to true, and enforce the sql.restrictPublicIp boolean constraint set to true at the organization node.

Enforce the compute.disableVpcExternalIpv6 boolean constraint, set the iam.automaticIamGrantsForDefaultServiceAccounts constraint to true, and configure storage.publicAccessPrevention at the organization node.

Professional Cloud DevOps Engineer

Org Policy Constraints Vm Ip Sql Vpc

Related questions