1.5 Defining the Resource Hierarchy PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company's security policy requires that all Compute Engine VM instances in the organization must have Shielded VM features enabled. The security team wants to enforce this policy centrally so that it applies to all current and future projects. What should they do?

   • ASet an organization policy with the constraint compute.requireShieldedVm at the organization level.
   • BCreate a custom organization policy constraint that checks for the Shielded VM setting.
   • CGrant the 'Compute Admin' role to the security team so they can manually audit and fix each VM.
   • DApply the policy at the project level for each existing project.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   How do IAM policies inherit down the Google Cloud resource hierarchy?

   • APolicies set at a parent level are inherited by all child resources.
   • BPolicies are only inherited between folders, not to projects.
   • CPolicies are inherited only if the child resource has no policy of its own.
   • DPolicies must be explicitly copied to each child resource.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which scenario best demonstrates leveraging hierarchy inheritance for access control?

   • AGranting a service account the Storage Admin role on a specific bucket.
   • BGranting a user the Viewer role on a single VM instance.
   • CGranting a user the Owner role on the organization node.
   • DGranting a team the Editor role on a folder that contains all their projects.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the effect of applying the 'Disable Service Account Key Creation' constraint at the project level?

   • AIt allows only the project owner to create service account keys.
   • BIt prevents all users from creating service account keys in that project.
   • CIt deletes all existing service account keys in the project.
   • DIt requires all service account keys to be rotated every 30 days.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company is migrating its projects from a flat structure to a folder-based hierarchy. They have 200 projects that need to be moved into folders based on their business unit. The security team is concerned about the impact on existing IAM policies and organization policies. What is the primary consideration when moving these projects?

   • AMoving a project changes its parent, which affects the inheritance of IAM policies and organization policies from the new folder.
   • BMoving a project will require re-creating all IAM bindings that were set at the project level.
   • CMoving a project will change the project ID and all resource names.
   • DMoving a project will cause all resources in the project to be temporarily unavailable.
   Reveal Solution Discussion Select an answer first