Configure Dry Run Organization Policy

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A security engineer is tasked with evaluating the operational impact of a new constraint for the gcp.restrictServiceUsage organization policy across an enterprise resource hierarchy. The organization already has an active live policy configured on the organization node that restricts certain API services.

The engineer needs to configure the new constraint rules in dry-run mode to generate violation logs in Cloud Audit Logs without disrupting developer operations or modifying the existing live enforcement rules.

Which procedure should the security engineer follow using the Google Cloud CLI?

Create a policy YAML file defining the new rules under the spec field with enforce: false and action: audit, and execute gcloud org-policies set-policy POLICY_PATH --update-mask=spec.

Create a policy YAML file defining the new rules under policyControllerSpec with enforcementAction: dryrun, and execute gcloud org-policies set-policy POLICY_PATH --dry-run.

Create a policy YAML file defining the new rules under the dryRunSpec field, and execute gcloud org-policies set-policy POLICY_PATH --update-mask=dryRunSpec.

Create a policy YAML file defining the new rules under the spec field with a CEL condition condition.auditMode(), and execute gcloud org-policies apply POLICY_PATH --audit-only.

Professional Cloud Security Engineer

Configure Dry Run Organization Policy

Related questions