Google Associate Cloud Engineer Question 9
Single answerGoogle Cloud PlatformYour organization has a Google Cloud Platform (GCP) resource hierarchy consisting of multiple projects under a single folder. The security team has mandated that all Compute Engine instances across the organization must disable external IPs by default for enhanced security. As an Associate Cloud Engineer, how would you enforce this policy across all projects in the folder?
- A
A. Set the 'Compute Engine external IPs' restriction at the folder level using the Organization Policy service.
- B
B. Manually disable external IPs for each Compute Engine instance in every project.
- C
C. Use Identity and Access Management (IAM) roles to restrict the assignment of external IPs.
- D
D. Implement a VPC Service Control perimeter to block external IPs for Compute Engine instances.
Show answer and explanation
Correct answer: A
Explanation
To enforce a consistent policy across multiple projects in GCP, using the Organization Policy service is the most effective method. By setting the 'Compute Engine external IPs' restriction at the folder level, you ensure that all projects under the folder inherit this policy, automatically disabling external IPs on Compute Engine instances across the organization.
- A. Correct.
A. Correct. Setting the 'Compute Engine external IPs' restriction at the folder level using the Organization Policy service ensures the policy is automatically enforced across all projects within the folder.
- B. Incorrect.
B. Incorrect. Manually disabling external IPs for each instance is error-prone and not scalable across multiple projects.
- C. Incorrect.
C. Incorrect. IAM roles manage permissions but do not directly control resource configurations like external IP assignments.
- D. Incorrect.
D. Incorrect. VPC Service Controls are used to define security perimeters, not to enforce instance-level configurations like disabling external IPs.