Your company must follow industry specific regulations. Therefore, you need to enforce customer-managed encryption keys (CMEK) for all new Cloud Storage resources in the organization called org1…

Question

Options

• A
  • organization poli-cy:constraints/gcp.restrictStorageNonCmekServices
• B
  • organization policy: con-straints/gcp.restrictNonCmekServices
• C
  • organization policy: con-straints/gcp.restrictStorageNonCmekServices
• D
  • organization policy: con-straints/gcp.restrictNonCmekServices

• A
  2% (1)
• B
  89% (39)
• C
  2% (1)
• D
  7% (3)

Explanation

The correct organization policy constraint to enforce CMEK across Google Cloud services is constraints/gcp.restrictNonCmekServices. When applied to an organization with the value storage.googleapis.com, it prevents the creation of Cloud Storage resources that are not protected by CMEK. The constraint constraints/gcp.restrictStorageNonCmekServices (options A and C) does not exist as a valid Google Cloud organization policy constraint. Options A and C are therefore distractors with a fabricated constraint name. Option B applies the correct, valid constraint that Google Cloud supports for enforcing CMEK on storage services.

No community discussion yet for this question.