PCSE Question 51

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• 1

  Correct Answer is: A. Option B suggests listing the trusted projects as exceptions in a deny operation, which is not necessary or recommended. It's simpler and more secure to explicitly allow only the trusted project

• Chose A3

  To limit the images that can be used as the source for boot disks and store these images in a dedicated project, you should use option A: A. Use the Organization Policy Service to create a compute.trustedimageProjects constraint on the organization level. List the trusted project as the whitelist in an allow operation. Here's why this option is appropriate: Organization-Wide Control: Creating an organization-level constraint allows you to enforce the policy organization-wide, ensuring consistent image usage across all projects within the organization. Whitelist Approach: By listing the trusted project as a whitelist in an "allow" operation, you explicitly specify which project can be trusted as the source for boot disks. This is a more secure approach because it only allows specific trusted projects. Dedicated Project: You mentioned that the images are stored in a dedicated project, and this option aligns with that requirement.

• 1

  Option B introduces complexity by listing the trusted projects as exceptions in a "deny" operation, which can become challenging to manage as more projects are added.