Professional Cloud DevOps Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
Your enterprise organization is bootstrapping its landing zone across multiple Google Cloud folders and projects. As a DevOps engineer, you are tasked with defining baseline preventative controls at the organization node to establish security guardrails across the entire resource hierarchy while still allowing folder- or project-level exceptions where strictly necessary.
Your implementation must satisfy the following requirements:
Which set of organization policy constraints should you configure and enforce at the organization node?
Enforce the compute.vmExternalIpAccess constraint with a policy denying all external IP addresses, enforce the compute.skipDefaultNetworkCreation boolean constraint set to true, and enforce the sql.restrictPublicIp boolean constraint set to true at the organization node.
Enforce the compute.disableVpcExternalIpv6 boolean constraint, set the iam.automaticIamGrantsForDefaultServiceAccounts constraint to true, and configure storage.publicAccessPrevention at the organization node.
Apply a hierarchical firewall policy denying all egress to 0.0.0.0/0 at the organization root and implement IAM Deny policies targeting compute.instances.create and sql.instances.create across all folders.
Create custom CEL constraints on compute.googleapis.com/Instance and sqladmin.googleapis.com/Instance and enforce them individually on each project without configuring policies at the organization root.
Enforce the compute.vmExternalIpAccess constraint with a policy denying all external IP addresses, enforce the compute.skipDefaultNetworkCreation boolean constraint set to true, and enforce the sql.restrictPublicIp boolean constraint set to true at the organization node.
The Organization Policy Service provides centralized, programmatic guardrails that govern resource configurations across an entire Google Cloud resource hierarchy. Applying managed constraints at the organization node ensures that preventative security baselines automatically cascade down to all child folders, projects, and resources via inheritance, even restricting users with privileged project-level IAM roles.
StudyCerts
StudyCertscompute.vmExternalIpAccess with a list policy configured to deny all external IP values (or an empty allowlist) blocks Compute Engine instances from being assigned public IPv4 addresses upon creation or network interface update.compute.skipDefaultNetworkCreation ensures that when the Compute Engine API is activated in newly created projects, Google Cloud skips the generation of the default VPC network and its default firewall rules.sql.restrictPublicIp blocks the assignment of public IP addresses on Cloud SQL database instances, requiring workloads to leverage private IP networking or authorized proxy configurations.Leveraging Google-managed organization policy constraints (compute.vmExternalIpAccess, compute.skipDefaultNetworkCreation, and sql.restrictPublicIp) is the native, platform-recommended mechanism to establish strict infrastructure configuration guardrails across the organization resource hierarchy.
Enforce the compute.disableVpcExternalIpv6 boolean constraint, set the iam.automaticIamGrantsForDefaultServiceAccounts constraint to true, and configure storage.publicAccessPrevention at the organization node.
Apply a hierarchical firewall policy denying all egress to 0.0.0.0/0 at the organization root and implement IAM Deny policies targeting compute.instances.create and sql.instances.create across all folders.
Create custom CEL constraints on compute.googleapis.com/Instance and sqladmin.googleapis.com/Instance and enforce them individually on each project without configuring policies at the organization root.