Google Professional Cloud Security Engineer Exam - Topic 1 Question 87 Discussion

Actual exam question for Google's Professional Cloud Security Engineer exam

Question #: 87
Topic #: 1

[All Professional Cloud Security Engineer Questions]

Your Google Cloud environment has one organization node, one folder named Apps." and several projects within that folder The organizational node enforces the constraints/iam.allowedPolicyMemberDomains organization policy, which allows members from the terramearth.com organization The "Apps" folder enforces the constraints/iam.allowedPolicyMemberDomains organization policy, which allows members from the flowlogistic.com organization. It also has the inheritFromParent: false property.

You attempt to grant access to a project in the Apps folder to the user testuser@terramearth.com.

What is the result of your action and why?

AThe action fails because a constraints/iam.allowedPolicyMemberDomains organization policy must
be defined on the current project to deactivate the constraint temporarily.

BThe action fails because a constraints/iam.allowedPolicyMemberDomains organization policy is in place and only members from the flowlogistic.com organization are allowed.

CThe action succeeds because members from both organizations, terramearth. com or flowlogistic.com, are allowed on projects in the 'Apps' folder

DThe action succeeds and the new member is successfully added to the project's Identity and Access Management (1AM) policy because all policies are inherited by underlying folders and projects.

Show Suggested Answer

Suggested Answer: A, C

https://cloud.google.com/architecture/framework/security/data-residency-sovereignty#manage_your_operational_sovereignty

by Gail at Sep 11, 2024, 02:33 AM

Limited Time Offer

25%

Off

Get Premium Professional Cloud Security Engineer Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Eileen

4 months ago

So, does that mean we can't grant access to users from terramearth.com at all?

upvoted 0 times

...

Eden

4 months ago

B is definitely the right answer here.

upvoted 0 times

...

Melvin

4 months ago

Wait, I thought policies could be overridden?

upvoted 0 times

...

Dahlia

4 months ago

Totally agree, only flowlogistic.com members can access it.

upvoted 0 times

...

Michael

5 months ago

The action fails because of the policy restrictions.

upvoted 0 times

...

Isadora

5 months ago

I thought policies could be overridden, but this question seems to indicate that the restrictions are strict. So, maybe it fails?

upvoted 0 times

...

Ranee

5 months ago

I practiced a similar question, and I believe the constraints on the folder would prevent adding a user from terramearth.com.

upvoted 0 times

...

Tawna

5 months ago

I'm not entirely sure, but I remember something about inherited policies. Could it be that the project inherits the restrictions from the Apps folder?

upvoted 0 times

...

Malcolm

5 months ago

I think the action fails because of the organization policy restricting access to flowlogistic.com members only.

upvoted 0 times

...

Yaeko

5 months ago

I've got a strategy in mind, but I want to make sure I'm not missing any important details. Gotta be careful with these organization policy questions.

upvoted 0 times

...

Milly

5 months ago

Whoa, this is a complex scenario. I'm going to take my time and make sure I understand all the moving parts before I select an answer.

upvoted 0 times

...

Pedro

5 months ago

Alright, time to put on my problem-solving hat. I think I know where to start, but I'll need to double-check my understanding of the organization policy rules.

upvoted 0 times

...

Shay

5 months ago

Okay, let me see here. The key seems to be the inheritFromParent: false property on the "Apps" folder. I'll need to consider how that affects the policy enforcement.

upvoted 0 times

...

Douglass

5 months ago

Hmm, this looks like a tricky one. I'll need to carefully read through the details and think through the organization policy constraints.

upvoted 0 times

...

Justine

6 months ago

I'm feeling pretty confident about this one. The sample data looks clear, and I know just the Python snippets I need to use to solve this.

upvoted 0 times

...

German

10 months ago

Wait, did they just try to sneak in a 'constraints/iam.allowedPolicyMemberDomains' policy on me? Talk about a mouthful! I'll stick with Option B and keep my sanity.

upvoted 0 times

...

Ellen

10 months ago

Hold on, does this mean I can just bypass all the organization policies by adding users directly to the project? Seems a bit too good to be true. I better go with Option B to be safe.

upvoted 0 times

...

Temeka

10 months ago

Aha, I see what they're trying to do here! The 'Apps' folder has the inheritFromParent: false property, so the action should fail. Option B is the way to go.

upvoted 0 times

Garry

9 months ago

Exactly, that's why option B is the correct answer.

upvoted 0 times

...

Audry

9 months ago

Yeah, you're right. The inheritFromParent property is set to false, so the action won't succeed.

upvoted 0 times

...

Carisa

9 months ago

I think the action fails because the 'Apps' folder only allows members from the flowlogistic.com organization.

upvoted 0 times

...

Francis

10 months ago

Hmm, I'm not sure about this one. The question seems a bit tricky, but I'm leaning towards Option B. Can't be too careful with those pesky organization policies!

upvoted 0 times

Stevie

8 months ago

Let's review the policies together to make sure we're on the right track.

upvoted 0 times

...

Pearly

9 months ago

I'm not so sure, maybe we should double-check the policies before making any changes.

upvoted 0 times

...

Rosita

9 months ago

Yeah, I agree. It's better to be cautious with these things.

upvoted 0 times

...

Rikki

9 months ago

I think Option B is correct. Those organization policies can be strict.

upvoted 0 times

...

Nickolas

10 months ago

The policy in the 'Apps' folder doesn't allow members from the terramearth.com organization, so the action should fail. Option B is the correct answer.

upvoted 0 times

...

Garry

10 months ago

Wait, did they just try to sneak in a 'constraints/iam.allowedPolicyMemberDomains' policy on me? Talk about a mouthful! I'll stick with Option B and keep my sanity.

upvoted 0 times

Chun

9 months ago

Definitely sticking with Option B, better safe than sorry with those constraints.

upvoted 0 times

...

Dulce

9 months ago

Yeah, Option B is the way to go. Can't risk messing with those policies.

upvoted 0 times

...

Alverta

10 months ago

I agree, that policy name is a mouthful! Option B seems like the safest choice.

upvoted 0 times

...

Jess

11 months ago

Hold on, does this mean I can just bypass all the organization policies by adding users directly to the project? Seems a bit too good to be true. I better go with Option B to be safe.

upvoted 0 times

Colette

10 months ago

User 2: Yeah, I agree. Option B seems like the safest choice in this situation.

upvoted 0 times

...

Lyndia

10 months ago

User 1: I think you're right, it might be risky to bypass the organization policies.

upvoted 0 times

...

Christiane

11 months ago

Aha, I see what they're trying to do here! The 'Apps' folder has the inheritFromParent: false property, so the action should fail. Option B is the way to go.

upvoted 0 times

...

Darrin

11 months ago

Hmm, I'm not sure about this one. The question seems a bit tricky, but I'm leaning towards Option B. Can't be too careful with those pesky organization policies!

upvoted 0 times

...

Joanna

11 months ago

The policy in the 'Apps' folder doesn't allow members from the terramearth.com organization, so the action should fail. Option B is the correct answer.

upvoted 0 times