An enterprise organization is establishing perimeter security and API governance across its Google Cloud resource hierarchy. A security engineer must implement controls to meet the following requirements: Requirement 1: Prevent project owners in the Development folder from activating or consuming any unapproved Google Cloud APIs, ensuring only an explicit allowlist of authorized services (such as Compute Engine and Cloud Storage) can be used. Requirement 2: Secure external API keys used by backend web servers so that the keys can only be used from authorized server IP addresses and can only invoke the designated backend service API. Which combination of controls should the security engineer implement to satisfy these requirements?

Apply the Restrict Service Usage (`constraints/gcp.restrictServiceUsage`) list constraint at the `Development` folder level with an allowlist of approved service identifiers, and configure API key restrictions with IP address application restrictions and specific API target restrictions.: ### What Restrict Service Usage and API Key Restrictions Are The **Restrict Service Usage** constraint (`constraints/gcp.restrictServiceUsage`) is a predefined Google Cloud Organization Policy list constraint that controls which Google Cloud services and APIs can be enabled and used within a specific resource hierarchy container (Organization, Folder, or Project). In parallel, **API Key Restrictions** provide granular defense-in-depth controls for credentials by restricting requests based on client context (such as IP addresses, HTTP referrers, or mobile app fingerprints) and restricting target API invocation scope. ### How it meets the requirements - **Requirement 1 (Enforce API allowlist across hierarchy):** Applying `constraints/gcp.restrictServiceUsage` at the `Development` folder with `spec.rules.allow.values` containing authorized service names (e.g., `compute.googleapis.com`, `storage.googleapis.com`) establishes an inheritance guardrail. Project owners within this folder cannot enable or make API calls to unapproved Google Cloud services, even if they possess project-level `roles/serviceusage.serviceUsageAdmin` privileges. - **Requirement 2 (Granular API key protection):** Configuring the API key with **IP address application restrictions** ensures that only requests originating from the designated backend server IP addresses/CIDR blocks are accepted. Adding **API restrictions** to the key ensures that the credential can only execute calls against the specified backend API service, mitigating token abuse if the key is compromised. ### Key advantages and capabilities - **Centralized Guardrails:** Organization policies operate above IAM, preventing project-level administrators from bypassing corporate service governance. - **Inheritance & Hierarchy:** Enforcing the policy at the `Development` folder automatically cascades down to all current and future projects in that folder. - **Defense-in-Depth for API Keys:** Combining application-level restrictions (IP addresses) with API target restrictions limits both *where* requests come from and *what* services can be invoked. - **Exfiltration & Abuse Prevention:** Prevents unauthorized shadow cloud service deployment and limits the blast radius of exposed credentials. ### Why this is optimal This approach uses native Google Cloud resource hierarchy guardrails for service enablement and follows security best practices for API credential scoping without requiring custom infrastructure proxies.

Enforce Restrict Service Usage Api Key Restrictions | Professional Cloud Security Engineer

Enforce Restrict Service Usage Api Key Restrictions

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise organization is establishing perimeter security and API governance across its Google Cloud resource hierarchy. A security engineer must implement controls to meet the following requirements:

Requirement 1: Prevent project owners in the Development folder from activating or consuming any unapproved Google Cloud APIs, ensuring only an explicit allowlist of authorized services (such as Compute Engine and Cloud Storage) can be used.
Requirement 2: Secure external API keys used by backend web servers so that the keys can only be used from authorized server IP addresses and can only invoke the designated backend service API.

Which combination of controls should the security engineer implement to satisfy these requirements?

Define Cloud Armor security policies to filter project API enablement endpoints, and configure API keys with OAuth 2.0 client IDs restricted to specific service accounts.

Apply the Restrict Service Usage (constraints/gcp.restrictServiceUsage) list constraint at the Development folder level with an allowlist of approved service identifiers, and configure API key restrictions with IP address application restrictions and specific API target restrictions.

Create an IAM Deny policy on the Development folder blocking the serviceusage.services.enable permission, and configure API keys with HTTP referrer restrictions without API target restrictions.

Configure a VPC Service Controls perimeter enclosing the Development folder projects with unrestricted service access, and configure API keys using Android application fingerprint restrictions.

Professional Cloud Security Engineer

Enforce Restrict Service Usage Api Key Restrictions

Related questions