Google Professional Cloud Security Engineer Question 175
Single answerGoogle Cloud PlatformYour organization wants to enforce a policy that restricts the creation of external IP addresses for all Compute Engine instances across all projects in the organization. As a Professional Cloud Security Engineer, how would you implement this using Google Cloud’s Organization Policy service?
- A
Create a custom IAM role that denies the 'compute.instances.create' permission and assign it at the organization level.
- B
Navigate to the Organization Policy page, configure the 'constraints/compute.vmExternalIpAccess' constraint, and enforce it at the organization level.
- C
Use Google Cloud Firewall rules to block traffic to all external IP addresses and apply it across all projects.
- D
Write a Cloud Function to monitor Compute Engine instances and automatically remove external IP addresses when detected.
Show answer and explanation
Correct answer: B
Explanation
The Organization Policy service in Google Cloud allows administrators to set and enforce policies across the organization, folders, or projects. The 'constraints/compute.vmExternalIpAccess' is a pre-built constraint specifically designed to manage external IP addresses on Compute Engine instances. Enforcing this constraint ensures compliance with the organization’s security requirements, without the need for custom scripts or overly broad IAM role modifications.
- A. Incorrect.
IAM roles control access to specific actions but do not enforce constraints on resources. This option is incorrect because it does not prevent the creation of external IP addresses; it only impacts who can perform certain actions.
- B. Correct.
This is the correct answer. The 'constraints/compute.vmExternalIpAccess' constraint is a pre-built organization policy that restricts the use of external IPs for VM instances. Enforcing this constraint at the organization level ensures that it applies to all projects under the organization.
- C. Incorrect.
Firewall rules control network traffic but cannot enforce restrictions on the creation of external IP addresses. This approach would not prevent external IP addresses from being assigned during VM instance creation, so it is incorrect.
- D. Incorrect.
While this approach could work, it is not a best practice or recommended method. Writing a custom Cloud Function to scan for and remove external IPs is inefficient and introduces unnecessary operational complexity.