An enterprise is deploying a centralized analytics lakehouse on Google Cloud to process data across multiple business units. As the lead data engineer, you must establish an enterprise-level security baseline using Organization Policy constraints applied at the root organization node. The baseline must satisfy three security requirements: Enforce strict data sovereignty by restricting resource provisioning solely to approved geographic regions. Mitigate credential exfiltration risks by blocking the generation of downloadable, long-lived service account keys. Prevent accidental exposure of sensitive datasets by blocking public and anonymous internet access across all cloud storage buckets. Which set of organization policy constraints should you enforce at the organization level to meet these requirements?

Enforce `constraints/gcp.resourceLocations`, `constraints/iam.disableServiceAccountKeyCreation`, and `constraints/storage.publicAccessPrevention` across the organization hierarchy.: What the Solution Is Google Cloud Organization Policies provide centralized governance across the resource hierarchy (Organization, Folders, and Projects). They enforce guardrails and constraints on resources regardless of the Cloud IAM roles granted to individual developers. How It Meets the Requirements Strict Data Sovereignty (constraints/gcp.resourceLocations): This list constraint restricts the physical locations where new resources across supported Google Cloud services (such as BigQuery, Dataproc, Cloud Spanner, and Cloud Storage) can be created, ensuring full compliance with corporate data residency policies. Disabling Service Account Keys (constraints/iam.disableServiceAccountKeyCreation): This boolean constraint prevents users and automated processes from creating external, user-managed private keys (.json or .p12) for service accounts, thereby eliminating the attack vector of leaked credentials. Blocking Public Access (constraints/storage.publicAccessPrevention): This boolean constraint enforces Public Access Prevention on Cloud Storage buckets, denying all operations that grant public access permissions (such as allUsers and allAuthenticatedUsers) via IAM policies or ACLs. Key Advantages Hierarchical Inheritance: Applying these constraints at the organization node automatically propagates protection down to all current and future folders and projects. Preventative Guardrails: Prevents misconfigurations before resources are created, eliminating human error. Compliance and Audit Readiness: Centralizes governance enforcement, simplifying regulatory reporting. Zero Friction with Native Identity: Enforces modern security patterns such as workload identity federation and short-lived credentials instead of static service account keys. Why This Is Optimal This approach directly targets the exact built-in organization policy constraints designed to enforce geographic boundaries, credential protection, and storage exposure prevention natively without relying on post-deployment scripts or manual reviews.

StudyCerts

Professional Cloud Data Engineer

professional-cloud-data-engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Enterprise Org Policy Baseline Data Security

Section: Identity and Access Management (e.g., Cloud IAM and organization policies)

An enterprise is deploying a centralized analytics lakehouse on Google Cloud to process data across multiple business units. As the lead data engineer, you must establish an enterprise-level security baseline using Organization Policy constraints applied at the root organization node.

The baseline must satisfy three security requirements:

Enforce strict data sovereignty by restricting resource provisioning solely to approved geographic regions.
Mitigate credential exfiltration risks by blocking the generation of downloadable, long-lived service account keys.
Prevent accidental exposure of sensitive datasets by blocking public and anonymous internet access across all cloud storage buckets.

Which set of organization policy constraints should you enforce at the organization level to meet these requirements?

Apply IAM Deny policies targeting resourcemanager.projects.create, iam.serviceAccountKeys.create, and storage.buckets.setIamPolicy on all developer groups.

Implement custom Secret Manager policies with custom.ensureVersionDestroyTTLAtLeast30hours and attach VPC Service Controls perimeters around each individual project.

Configure constraints/compute.vmExternalIpAccess, constraints/iam.allowServiceAccountCredentialLifetime, and constraints/storage.uniformBucketLevelAccess at the organization node.

Enforce constraints/gcp.resourceLocations, constraints/iam.disableServiceAccountKeyCreation, and constraints/storage.publicAccessPrevention across the organization hierarchy.

Professional Cloud Data Engineer

professional-cloud-data-engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Enterprise Org Policy Baseline Data Security

Section: Identity and Access Management (e.g., Cloud IAM and organization policies)

The baseline must satisfy three security requirements:

Enforce strict data sovereignty by restricting resource provisioning solely to approved geographic regions.
Mitigate credential exfiltration risks by blocking the generation of downloadable, long-lived service account keys.
Prevent accidental exposure of sensitive datasets by blocking public and anonymous internet access across all cloud storage buckets.

Which set of organization policy constraints should you enforce at the organization level to meet these requirements?

Apply IAM Deny policies targeting resourcemanager.projects.create, iam.serviceAccountKeys.create, and storage.buckets.setIamPolicy on all developer groups.

Implement custom Secret Manager policies with custom.ensureVersionDestroyTTLAtLeast30hours and attach VPC Service Controls perimeters around each individual project.

Configure constraints/compute.vmExternalIpAccess, constraints/iam.allowServiceAccountCredentialLifetime, and constraints/storage.uniformBucketLevelAccess at the organization node.

Enforce constraints/gcp.resourceLocations, constraints/iam.disableServiceAccountKeyCreation, and constraints/storage.publicAccessPrevention across the organization hierarchy.

Explanations

What the Solution Is

Google Cloud Organization Policies provide centralized governance across the resource hierarchy (Organization, Folders, and Projects). They enforce guardrails and constraints on resources regardless of the Cloud IAM roles granted to individual developers.

How It Meets the Requirements

Strict Data Sovereignty (constraints/gcp.resourceLocations): This list constraint restricts the physical locations where new resources across supported Google Cloud services (such as BigQuery, Dataproc, Cloud Spanner, and Cloud Storage) can be created, ensuring full compliance with corporate data residency policies.
Disabling Service Account Keys (constraints/iam.disableServiceAccountKeyCreation): This boolean constraint prevents users and automated processes from creating external, user-managed private keys (.json or .p12) for service accounts, thereby eliminating the attack vector of leaked credentials.
Blocking Public Access (constraints/storage.publicAccessPrevention): This boolean constraint enforces Public Access Prevention on Cloud Storage buckets, denying all operations that grant public access permissions (such as allUsers and allAuthenticatedUsers) via IAM policies or ACLs.

Key Advantages

Hierarchical Inheritance: Applying these constraints at the organization node automatically propagates protection down to all current and future folders and projects.
Preventative Guardrails: Prevents misconfigurations before resources are created, eliminating human error.
Compliance and Audit Readiness: Centralizes governance enforcement, simplifying regulatory reporting.
Zero Friction with Native Identity: Enforces modern security patterns such as workload identity federation and short-lived credentials instead of static service account keys.

Why This Is Optimal

This approach directly targets the exact built-in organization policy constraints designed to enforce geographic boundaries, credential protection, and storage exposure prevention natively without relying on post-deployment scripts or manual reviews.

View source documentation

Professional Cloud Data Engineer

Enterprise Org Policy Baseline Data Security

Professional Cloud Data Engineer

Enterprise Org Policy Baseline Data Security

What the Solution Is

How It Meets the Requirements

Key Advantages

Why This Is Optimal

Related questions