You define central security controls in your Google Cloud environment. For one of the folders in your organization, you set an organizational policy to deny the assignment of external IP addresses…

Question

Options

• AThe VM was created with a static external IP address that was reserved in the project before the
• BThe organizational policy constraint wasn't properly enforced and is running in "dry run" mode.
• CA project level, the organizational policy control has been overwritten with an "allow" value.
• DThe policy constraint on the folder level does not have any effect because of an "allow" value for

• A
  5% (2)
• B
  9% (4)
• C
  70% (30)
• D
  16% (7)

Explanation

In Google Cloud, organizational policies follow a hierarchy: organization > folder > project. By default, child resources can override parent policies unless inheritance is enforced with 'merge' or 'deny override' rules. If a project beneath the restricted folder has its own policy that explicitly 'allows' external IP assignment, that project-level policy overrides the folder-level deny. This is why a VM under that folder could still receive an external IP - the project-level allow overrode the folder-level deny. Option A is incorrect because reserved static IPs are still subject to org policy enforcement. Option B is possible but 'dry run' mode is a monitoring feature that would not typically cause an unexpected production alert. Option D is incomplete as written, but the concept it hints at (an allow at a higher level overriding) doesn't apply here since the deny was set at the folder level, which is below the organization.

No community discussion yet for this question.