GCP Professional Data Engineer Practice Question

A global bank organizes its Google Cloud resources under two top-level folders: Finance and Sandbox. Security mandates that absolutely no Compute Engine VM in the Finance folder-existing or future-may obtain a public IPv4 or IPv6 address, while Sandbox projects must retain the ability to create publicly reachable test VMs. Network administrators want a single control that is inherited by all Finance projects and cannot be relaxed by individual project owners. What is the most appropriate solution?

Move all Finance projects into a Shared VPC that exposes only internal subnets and disallow individual projects from creating their own VPC networks.
Create a VPC Service Controls perimeter around all Finance projects and block the 0.0.0.0/0 and ::/0 address ranges.
Add a firewall rule in every Finance project that denies egress to the internet and rely on Cloud NAT for outbound private traffic.
Enforce the constraints/compute.vmExternalIpAccess organization policy at the Finance folder with a deny-all rule so no service account can attach an external IP, inheriting the policy to every Finance project.

Report Issue

Answer Description

The compute.vmExternalIpAccess organization policy constraint lets administrators control which service accounts are permitted to attach external IP addresses to Compute Engine VMs. Applying the policy high in the resource hierarchy makes it effective for every descendant project. Setting the policy at the Finance folder with an empty allowed list (or an explicit deny on "all") prevents any VM in those projects from receiving a public address. Because organization policies are hierarchical and additive, project owners cannot override a more restrictive parent policy, satisfying the compliance requirement with minimal ongoing effort.

VPC Service Controls protect data plane access to Google APIs but do not stop a VM from getting an external IP. Shared VPC design or firewall rules require per-project or per-network configuration and can be changed by project owners. Therefore, enforcing the compute.vmExternalIpAccess constraint at the folder level is the correct and most operationally efficient choice.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.