1.5 Defining the Resource Hierarchy PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An organization has set an organization policy at the organization level that restricts the external IP addresses that can be assigned to VM instances. A specific project in a folder needs to allow a broader set of external IPs for a temporary development environment. How can this be achieved?

   • ACreate a new folder for the project and move it under that folder, then set the policy on the new folder.
   • BSet a new organization policy at the project level that allows the broader set of IPs.
   • CRemove the organization-level policy and rely on IAM permissions to control IP assignment.
   • DAsk the organization administrator to temporarily disable the policy for the entire organization.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is a pre-built organization policy constraint provided by Google Cloud?

   • ADefine custom IAM roles
   • BRequire MFA for all users
   • CRestrict resource locations
   • DSet password complexity rules
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which tool or service is designed to help manage many projects and folders at scale by allowing you to define and apply configurations programmatically?

   • ACloud Resource Manager API
   • BCloud Shell
   • CCloud Deployment Manager
   • DTerraform
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is required to define a custom organization policy constraint in Google Cloud?

   • AA SQL query that runs against the Cloud Asset Inventory
   • BA Cloud Function that validates resource creation
   • CA YAML file that defines the constraint and a rule
   • DA Python script that uses the Cloud Resource Manager API
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company is organizing its Google Cloud environment. The security team wants to grant a group of network administrators read-only access to all VPC firewall rules and routes across every project in the organization, but they should NOT be able to view any other resource types. The company has an organization node and several folders. What is the most efficient way to grant this access?

   • AGrant the 'Viewer' predefined role to the network administrators group at the organization level.
   • BCreate a custom role with compute.firewalls.list and compute.routes.list, then bind it to each individual project.
   • CCreate a custom IAM role with only compute.firewalls.get and compute.routes.get permissions, then bind it to the network administrators group at the organization level.
   • DGrant the network administrators the Predefined 'Compute Network Admin' role at the organization level.
   Reveal Solution Discussion Select an answer first