Google Professional Cloud Security Engineer Question 174
Single answerGoogle Cloud PlatformYour organization uses Google Cloud and has a strict security policy requiring projects to restrict the creation of external IP addresses. As a Professional Cloud Security Engineer, you need to enforce this policy across all projects without disrupting existing workloads. What is the most appropriate way to achieve this?
- A
Create a custom IAM role that denies the creation of external IP addresses and assign it to all users.
- B
Set an organization policy that enforces the constraint 'constraints/compute.vmExternalIpAccess' and apply it at the organization level.
- C
Manually audit all projects and remove any external IP addresses that are found.
- D
Deploy a VPC Service Control perimeter to block external IP creation across all projects.
Show answer and explanation
Correct answer: B
Explanation
The correct approach to enforce the restriction on external IP addresses across all projects in the organization is to use an organization policy. The specific constraint 'constraints/compute.vmExternalIpAccess' directly addresses this requirement. By setting this policy at the organization level, it ensures that all projects inherit the restriction, providing a scalable and enforceable solution in line with Google Cloud's best practices for managing organization policies.
- A. Incorrect.
IAM roles do not provide mechanisms to restrict resource behavior like external IP creation; they control access to resources instead. This is not the correct approach.
- B. Correct.
The 'constraints/compute.vmExternalIpAccess' organization policy is designed to enforce restrictions on external IP use. Applying this policy at the organization level ensures the constraint is inherited by all projects, aligning with the organization's security requirements.
- C. Incorrect.
Manual audits are not scalable or enforceable across multiple projects. This approach does not provide a way to prevent the creation of external IPs in the future.
- D. Incorrect.
VPC Service Controls enhance security at the service perimeter level but are not designed to enforce organization-wide constraints like restricting external IP creation.