GCP Associate Cloud Engineer Practice Question

You are the organization administrator for ExampleCorp's Google Cloud environment. Security mandates that no new Compute Engine VM in any project should obtain an external IPv4 address, except for the network-engineering team that works only in the vpc-test project. Which configuration best meets this requirement while preserving least-privilege and minimizing repetitive work?

Create an IAM Deny policy at the Organization level that blocks the compute.instances.create permission for all users, then add an allow rule in the vpc-test project.
Grant the network-engineering team the Compute Instance Admin role in the vpc-test project and remove that role from all other projects.
Delete the default VPC network from every project and create custom VPCs without Internet gateways; leave the default network intact in the vpc-test project.
Apply the compute.vmExternalIpAccess constraint at the Organization level with "enforce" set to true (deny all), then add a project-level policy on vpc-test that allows only the network-engineering service account to use external IP addresses.

Report Issue

Answer Description

The compute.vmExternalIpAccess organization-policy constraint controls whether VMs can be created with external IPv4 addresses. By setting a policy at the Organization node that denies all principals, every folder and project automatically inherits the restriction. Because policies are inherited but can be overridden lower in the hierarchy, you can add a second policy only on the vpc-test project that specifies the network-engineering service account in the allowed list (or simply clears the enforcement flag). This keeps the default deny posture everywhere, avoids per-project repetition, and follows the principle of least privilege. The other options either rely on IAM roles (which do not block external IP assignment), network topologies that do not stop users from requesting external IPs, or IAM Deny rules that do not offer the fine-grained exception handling provided by the organization-policy constraint.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.