1.5 Defining the Resource Hierarchy PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company wants to enforce a policy that disables the ability to enable the 'Service Account Key Creation' for all projects in the organization. This is to prevent the creation of long-lived service account keys. What is the correct way to implement this?

   • ACreate a custom organization policy that checks for the existence of service account keys and deletes them.
   • BGrant the 'Service Account Key Admin' role to a security group so they can audit and remove keys.
   • CSet the organization policy constraint 'iam.disableServiceAccountKeyCreation' at the organization level.
   • DSet the constraint at the project level for each project individually.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company wants to ensure that all VM instances in a specific folder are created with a specific set of labels for cost tracking. They have identified the predefined constraint 'compute.requireOsLogin' but that is not what they need. What should they do?

   • AUse a Cloud Function to automatically add labels to any VM that is created without them.
   • BUse the 'compute.requireOsLogin' constraint and modify it to check for labels.
   • CGrant the 'Compute Admin' role to the security team so they can manually add labels to any VM that is missing them.
   • DUse a custom organization policy constraint to enforce the presence of the required labels on VM instances.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company is setting up its Google Cloud resource hierarchy. They have multiple business units, each with its own set of projects. They want to apply different organization policies to different business units. What is the correct way to structure the resource hierarchy to achieve this?

   • ACreate a folder for each business unit, place their projects inside the folders, and apply the organization policies at the folder level.
   • BApply all organization policies at the organization level and use IAM to restrict access.
   • CCreate a separate organization node for each business unit.
   • DCreate a single project for all business units and use labels to differentiate them.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which statement accurately describes the Google Cloud resource hierarchy and its role in access control?

   • AThe resource hierarchy is a flat structure where each project is independent and IAM policies must be set individually on every resource.
   • BThe resource hierarchy includes organization, folders, projects, and resources, but IAM policies are only applied at the project level.
   • CThe resource hierarchy is used only for billing and cost management, not for access control.
   • DThe resource hierarchy consists of organization, folders, projects, and resources, with IAM policies inherited from parent to child nodes.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary purpose of organization policies in Google Cloud?

   • ATo define IAM roles and permissions
   • BTo manage billing accounts and budgets
   • CTo enforce constraints on resources across the hierarchy
   • DTo create and manage folders and projects
   Reveal Solution Discussion Select an answer first