Your team wants to make sure Compute Engine instances running in your production project do not have public IP addresses. The frontend application Compute Engine instances will require public IPs…

Question

Options

• AEnable Private Access on the VPC network in the production project.
• BRemove the Editor role and grant the Compute Admin IAM role to the engineers.
• CSet up an organization policy to only permit public IPs for the front-end Compute Engine
• DSet up a VPC network with two subnets: one with public IPs and one without public IPs.

• A
  7% (2)
• B
  4% (1)
• C
  85% (23)
• D
  4% (1)

Explanation

Organization Policies with the 'compute.vmExternalIpAccess' constraint allow administrators to define exactly which VM instances (by resource path) are permitted to have external (public) IP addresses. This is a policy-level enforcement that cannot be overridden by users who only have the Editor role, making it the correct approach. Option A (Private Google Access) allows VMs without public IPs to reach Google APIs - it does not prevent VMs from getting public IPs. Option B (changing IAM roles) would reduce permissions but does not technically enforce the IP restriction. Option D (subnet design) can influence IP assignment but does not strictly enforce it the way an Org Policy constraint does.

No community discussion yet for this question.