GCP Professional Cloud Security Engineer Practice Question

The Corp folder contains all production projects, including analytics-prod. You set the organization-policy constraint constraints/storage.uniformBucketLevelAccess on Corp with enforced: true, making Uniform Bucket-Level Access mandatory for every Cloud Storage bucket below that folder. The analytics team needs a two-week exception to disable UBLA in the analytics-prod project for a migration. Which approach allows the exception without weakening the requirement for all other projects?

Move the analytics-prod project to a temporary sibling folder that has no UBLA policy, perform the migration there, then move the project back after two weeks while leaving the Corp policy unchanged.
Create a project-level policy on analytics-prod that sets enforced: false for constraints/storage.uniformBucketLevelAccess during the migration and delete the policy afterward.
Add the analytics-prod project's default service account to the allowedValues list of the UBLA constraint at the Corp folder and remove it after the migration.
Grant analytics-prod project owners the roles/orgpolicy.policyAdmin role on the Corp folder so they can temporarily disable the UBLA constraint and re-enable it after the migration.

Report Issue

Answer Description

When a boolean organization-policy constraint is set with enforced: true, the restriction is absolute for that resource and all of its descendants; lower-level resources cannot override it. The only practical way to provide an exception is to move the affected project (analytics-prod) to a location in the resource hierarchy where the policy is not enforced, perform the required work, and then move it back. Creating a project-level policy that sets enforced: false will be ignored because the ancestor's enforced policy has higher precedence. Granting the project owners Organization Policy Admin at the Corp folder would let them change the policy for every project, which violates least privilege and jeopardizes compliance. Adding service accounts to an allowlist is impossible here because constraints/storage.uniformBucketLevelAccess is a boolean constraint and has no allowedValues list. Therefore, moving the project to a temporary folder without the constraint is the most secure and compliant solution.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.