Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Google Cloud Certified Professional Cloud Security Engineer · Google Cloud
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
and how would you want to separate front-end VM's from the other using Org Policy Constraints - IMO option D make more sense
Intitally I agreed with you but after looking at the link above it does say this. This list constraint defines the set of Compute Engine VM instances that are allowed to use external IP addresses. By default, all VM instances are allowed to use external IP addresses. The allowed/denied list of VM instances must be identified by the VM instance name, in the form: projects/PROJECT_ID/zones/ZONE/instances/INSTANCE constraints/compute.vmExternalIpAccess So you can indeed choose with instances have public ips https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints#constraints-for-specific-services Define allowed external IPs for VM instances
C. Set up an organization policy to only permit public IPs for the front-end Compute Engine instances.