Professional Cloud DevOps Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
An organization enforces strict data residency requirements by setting the constraints/gcp.resourceLocations constraint at the organization root with allowedValues set to European regions (in:eu-locations). A specialized data science team requires an exception to deploy new resources in us-central1 within their dedicated Google Cloud project, while maintaining European region access and preventing inheritance conflicts.
How should the DevOps engineer configure the organization policy on the target project to grant this exception?
Configure the target project's policy to merge with parent and add us-central1 into the project's deniedValues list.
Update the root organization policy to include us-central1 unconditionally, and grant the team the roles/orgpolicy.policyAdmin role to manage exceptions.
Delete the organization-level gcp.resourceLocations policy and recreate custom constraints for compute and storage resources in every project.
Override the parent policy on the target project (replace inheritance) and define allowedValues to include both in:eu-locations and us-central1.
Configure the target project's policy to merge with parent and add us-central1 into the project's deniedValues list.
Update the root organization policy to include us-central1 unconditionally, and grant the team the roles/orgpolicy.policyAdmin role to manage exceptions.
Delete the organization-level gcp.resourceLocations policy and recreate custom constraints for compute and storage resources in every project.
Override the parent policy on the target project (replace inheritance) and define allowedValues to include both in:eu-locations and us-central1.
In the Google Cloud Resource Hierarchy, organization policies are inherited down the tree by default from the organization root to folders and projects. When a child node (such as a specific project) requires an exception or modification to an inherited list constraint like constraints/gcp.resourceLocations, administrators can configure the policy on that specific resource node to override its parent by setting inheritFromParent: false (replacing parent rules rather than merging).
StudyCerts
StudyCertsin:eu-locations and us-central1 in the project's allowedValues list, the team retains the ability to provision resources in European regions while gaining access to us-central1.allowedValues or deniedValues lists.Replacing inheritance and providing the complete set of permitted values (in:eu-locations and us-central1) ensures deterministic control. If the administrator simply merged values, the parent policy would still restrict creation if restrictive rules conflicted.