Discuss Google Professional Cloud Security Engineer Exam Topic 4 Question 85

You have the following resource hierarchy. There is an organization policy at each node in the hierarchy as shown. Which load balancer types are denied in VPC A?

AAll load balancer types are denied in accordance with the global node's policy.

BINTERNAL_TCP_UDP, INTERNAL_HTTP_HTTPS is denied in accordance with the folder's policy.

CEXTERNAL_TCP_PROXY, EXTERNAL_SSL_PROXY are denied in accordance with the project's policy.

DEXTERNAL_TCP_PROXY, EXTERNAL_SSL_PROXY, INTERNAL_TCP_UDP, and INTERNAL_HTTP_HTTPS are denied in accordance with the folder and project's policies.

Suggested Answer: C, D

https://cloud.google.com/confidential-computing/confidential-vm/docs/creating-cvm-instance#considerations

Confidential VM does not support live migration. You can only enable Confidential Computing on a VM when you first create the instance. https://cloud.google.com/confidential-computing/confidential-vm/docs/creating-cvm-instance

Get Premium Professional Cloud Security Engineer Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

39 comments · newest first

Kristofer 11 months ago

I thought external load balancers were usually allowed, this is surprising!

Karon 11 months ago

Wait, are you sure about that? Seems like a lot to deny.

Julian 11 months ago

Totally agree with option D, seems like the most comprehensive.

Mozell 11 months ago

I think it's just INTERNAL_TCP_UDP and INTERNAL_HTTP_HTTPS that are denied.

Colette 12 months ago

All load balancer types are denied in VPC A.

Verda 12 months ago

I feel like option B could be correct since it specifically mentions the folder's policy, but I need to double-check the details on internal versus external load balancers.

Stephane 1 year ago

I'm a bit confused about the difference between the global node's policy and the folder's policy. Does anyone recall how that affects the load balancers?

Karl 1 year ago

I think we had a similar question in practice about load balancer types and their restrictions based on hierarchy. I might lean towards option D.

Ming 1 year ago

I remember that organization policies can override lower-level policies, but I'm not sure how that applies here.

Benedict 1 year ago

This seems straightforward enough. I just need to carefully read the policies and match them up with the load balancer types mentioned. As long as I don't miss any details, I should be able to get this right.

Novella 1 year ago

I'm a bit confused by the different policy levels. Do I need to consider all of them, or just the one that's closest to the VPC A resource? I want to make sure I don't overcomplicate my approach.

Jennie 1 year ago

Okay, let me think this through step-by-step. The global node's policy applies to all resources, so that's the first thing I need to check. Then I'll look at the folder and project policies to see if they override or add any additional restrictions.

Ilene 1 year ago

Hmm, this looks like a tricky one. I'll need to carefully analyze the resource hierarchy and the policies at each level to determine which load balancer types are denied in VPC A.

Veda 1 year ago

I've got a good strategy here. I'll start by identifying the load balancer types listed in the question, then check each policy level to see which ones are denied. That should give me the answer.

Helaine 1 year ago

This looks like a tricky one. I'll need to think through the different scenarios where the model might not be found, like issues with the Content Service or problems with the normalization rules.

Davida 1 year ago

Hmm, this question is a real head-scratcher. I bet the answer is hidden in the hieroglyphics of the resource hierarchy! *chuckles*

Sabra 1 year ago

↳ replying to Davida

That makes sense. It's important to pay attention to the policies at each level of the hierarchy.

Jesus 1 year ago

↳ replying to Davida

Yeah, I agree. The policies at both levels would deny those specific load balancer types.

Maricela 1 year ago

↳ replying to Davida

I think the answer is D, because it mentions both folder and project policies.

Yoko 1 year ago

This question is a real brain-teaser! I'm going to have to go with D. The folder and project policies combine to deny all the load balancer types listed.

Jody 1 year ago

↳ replying to Yoko

D is the best option here. The policies at both the folder and project levels restrict all the load balancer types mentioned.

Gail 1 year ago

↳ replying to Yoko

It's definitely a tricky question, but I also think D is the right choice. The combination of folder and project policies covers all the denied load balancer types.

Carin 1 year ago

↳ replying to Yoko

I agree, D is the correct answer. The policies at both the folder and project levels deny all the load balancer types.

Fletcher 2 years ago

I'm going with C. The project policy denies EXTERNAL_TCP_PROXY and EXTERNAL_SSL_PROXY, so those are the load balancer types that are denied in VPC A.

Gracie 1 year ago

↳ replying to Fletcher

Agreed. C is the right choice based on the project's policy for load balancer types in VPC A.

Lorita 1 year ago

↳ replying to Fletcher

I think C is the correct answer too. The project's policy is the one that applies to VPC A in this case.

Kerry 1 year ago

↳ replying to Fletcher

That makes sense. The project policy does specify those load balancer types to be denied.

Barrett 1 year ago

↳ replying to Fletcher

I'm going with C. The project policy denies EXTERNAL_TCP_PROXY and EXTERNAL_SSL_PROXY, so those are the load balancer types that are denied in VPC A.

Justa 2 years ago

But what about INTERNAL_TCP_UDP and INTERNAL_HTTP_HTTPS? Are they also denied?

Valentin 2 years ago

I agree with Jolanda. The project's policy specifically denies those types.

Vincenza 2 years ago

I'm not sure about this one. Let me think it through... Ah, I think B is the right answer. The folder policy denies INTERNAL_TCP_UDP and INTERNAL_HTTP_HTTPS, so those are the load balancer types that are denied in VPC A.

Micah 1 year ago

↳ replying to Vincenza

Yes, B is the right choice. The folder's policy specifically denies INTERNAL_TCP_UDP and INTERNAL_HTTP_HTTPS in VPC A.

Darrel 1 year ago

↳ replying to Vincenza

I agree, B is the correct answer. The folder policy dictates which load balancer types are denied in VPC A.

Alesia 2 years ago

Hmm, I think the correct answer is D. The folder and project policies both deny some types of load balancers, so the final set of denied load balancers would be EXTERNAL_TCP_PROXY, EXTERNAL_SSL_PROXY, INTERNAL_TCP_UDP, and INTERNAL_HTTP_HTTPS.

Jani 1 year ago

↳ replying to Alesia

Definitely, understanding the organization policy at each node is crucial for making the right decision.

Tina 1 year ago

↳ replying to Alesia

That makes sense, it's important to consider all levels of the hierarchy when determining the denied load balancer types.

Johna 1 year ago

↳ replying to Alesia

So, the correct answer would be D, which includes all the denied load balancer types from both policies.

Olga 1 year ago

↳ replying to Alesia

I agree, the folder and project policies both contribute to the denied load balancer types.

Jolanda 2 years ago

I think the denied load balancer types in VPC A are EXTERNAL_TCP_PROXY and EXTERNAL_SSL_PROXY.

Google Professional Cloud Security Engineer Exam - Topic 4 Question 85 Discussion