You work for a global company. Due to compliance requirements, certain Compute Engine instances that reside within specific projects must be located exclusively in cloud regions within the European…

Question

Options

• AUse a third-party configuration management tool to monitor the location of Compute Engine
• BDeploy a Security Command Center source to detect Compute Engine instances created outside
• CUse organization policy constraints in Resource Manager to enforce allowed regions for Compute
• DSet an organization policy that denies the creation of Compute Engine instances outside the EU.

• A
  3% (1)
• B
  3% (1)
• C
  10% (3)
• D
  84% (26)

Explanation

Organization policies in Google Cloud Resource Manager allow administrators to enforce constraints at the organization, folder, or project level. The constraints/gcp.resourceLocations constraint can restrict allowed regions to EU-only for Compute Engine instance creation. Setting this at the organization level prevents any new non-compliant instances from being created across all projects. The full Option D also implies using Security Command Center or similar tooling to detect and remediate existing non-compliant instances. Option C uses an allowlist approach which is functionally similar, but Option D's deny-based framing is more explicit about also addressing existing violations. Options A and B rely on third-party tools or SCC detection alone, which are reactive rather than preventative.

No community discussion yet for this question.