Your organization has decided to restrict the use of external IP addresses on instances to only approved instances. You want to enforce this requirement across all of your Virtual Private Clouds…

Question

Options

• ARemove the default route on all VPCs. Move all approved instances into a new subnet that has a
• BCreate a new VPC in custom mode. Create a new subnet for the approved instances, and set a
• CImplement a Cloud NAT solution to remove the need for external IP addresses entirely.
• DSet an Organization Policy with a constraint on constraints/compute.vmExternalIpAccess. List the

• A
  11% (6)
• B
  5% (3)
• C
  2% (1)
• D
  82% (47)

Explanation

Option D is correct because Organization Policies with the constraints/compute.vmExternalIpAccess constraint are specifically designed to control which VM instances can have external IP addresses - this policy applies organization-wide across all projects and VPCs, enforcing the requirement at scale without manual per-VPC configuration.

Why the distractors fail:

• A - Removing default routes affects outbound internet traffic routing, not whether instances can be assigned external IPs; approved instances in a new subnet still doesn't prevent external IP assignment on other VPCs.
• B - Creating a new VPC in custom mode only controls that specific VPC; it does nothing to restrict external IPs on existing VPCs across the organization.
• C - Cloud NAT provides outbound internet access for instances without external IPs, but it doesn't prevent other instances from being assigned external IPs - it solves the wrong problem.

Memory tip: Think "Organization-wide rules need Organization Policies." Whenever an exam question asks you to enforce a constraint across all VPCs or all projects, the answer almost always involves an Organization Policy constraint - it's the only mechanism that operates at the org level above individual VPCs and projects.

No community discussion yet for this question.