Google Professional Cloud Security Engineer Question 176
Select 3Google Cloud PlatformYour organization uses Google Cloud and requires strict control over the locations where resources can be created. As a Professional Cloud Security Engineer, you are tasked with ensuring that all projects within the organization comply with this policy. You decide to use a pre-built organization policy to enforce this restriction. Which steps should you take to achieve this?
- A
Set up the 'constraints/gcp.resourceLocations' constraint at the organization level and specify allowed locations.
- B
Disable the 'constraints/iam.disableServiceAccountKeyCreation' constraint to prevent key creation in restricted regions.
- C
Apply the 'constraints/gcp.resourceLocations' constraint to all folders and projects individually instead of the organization level.
- D
Use the Google Cloud CLI to enforce the 'constraints/gcp.resourceLocations' constraint at the organization level.
- E
Test the policy in a development project before rolling it out organization-wide.
Show answer and explanation
Correct answers: A, D, E
Explanation
To manage resource location restrictions effectively, use the 'constraints/gcp.resourceLocations' pre-built organization policy at the organization level. This ensures consistent enforcement across all projects and folders. Using tools like the CLI can automate policy application, and testing policies in a development environment minimizes risk to production systems.
- A. Correct.
Correct. The 'constraints/gcp.resourceLocations' constraint is a pre-built organization policy designed to restrict resource creation to specific geographic locations. Applying it at the organization level ensures all projects inherit the restriction.
- B. Incorrect.
Incorrect. The 'constraints/iam.disableServiceAccountKeyCreation' constraint is unrelated to restricting resource locations. It is used to control service account key creation for security purposes.
- C. Incorrect.
Incorrect. Applying the constraint individually to folders and projects is inefficient and error-prone. Setting it at the organization level ensures consistent enforcement across all resources.
- D. Correct.
Correct. The Google Cloud CLI can be used to enforce the 'constraints/gcp.resourceLocations' constraint and manage organization policies programmatically.
- E. Correct.
Correct. Testing the policy in a development project ensures that it behaves as expected without impacting production environments.