Restricting External IPs via Root Organization Policy

CDL By islever Editorial Last updated

Trust and security in the cloud Operational excellence and reliability at scale

Short answer

A Define an organization policy at the root organization node to restrict virtual machine instances from having an external IP address.

Question

Your manager wants to restrict communication of all virtual machines with internet access; with resources in another network; or with a resource outside Compute
Engine. It is expected that different teams will create new folders and projects in the near future.
How would you restrict all virtual machines from having an external IP address?
  1. Define an organization policy at the root organization node to restrict virtual machine instances from having an external IP address Correct Answer
  2. Define an organization policy on all existing folders to define a constraint to restrict virtual machine instances from having an external IP address
  3. Define an organization policy on all existing projects to restrict virtual machine instances from having an external IP address
  4. Communicate with the different teams and agree that each time a virtual machine is created, it must be configured without an external IP address

Key Takeaways

The question tests the understanding of Google Cloud's resource hierarchy and the scalability of Organization Policies; applying policies at the root level ensures they automatically apply to all future resources.

To prevent VMs from having external IPs across all current and future projects and folders, define an Organization Policy at the root organization node. This ensures centralized enforcement of the compute.noExternalIP constraint.

Common mistake: Choosing Option B or C is common but wrong because they only apply to existing folders or projects, failing to protect new resources created by other teams as specified in the scenario.

Expert Analysis

The scenario requires restricting all virtual machines (VMs) from having an external IP address across the entire organization, including resources in Compute Engine. The key constraint is that "different teams will create new folders and projects in the near future," meaning any policy applied only to existing resources or lower levels would fail to cover future additions.

Option A is correct because Organization Policies allow administrators to define constraints at the root organization node. These policies propagate down the resource hierarchy (Organization > Folder > Project > Resource). By setting the constraint compute.noExternalIP at the root level, it automatically applies to all current and future folders, projects, and VM instances within the organization. This provides centralized control and ensures compliance without manual intervention for each new project.

Option B is incorrect because applying policies only to existing folders ignores future folders created by new teams. Additionally, managing policies on every folder individually is inefficient and prone to drift compared to a single root-level policy.

Option C is incorrect for similar reasons: it targets only existing projects and does not scale to future projects. It also violates the principle of least privilege by requiring per-project management instead of centralized governance.

Option D is incorrect because relying on manual configuration by different teams is error-prone and unenforceable. Automation and policy-as-code are required for consistent security posture in dynamic environments.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a question mentions 'future' resources or 'all teams,' look for solutions that operate at the highest level of the resource hierarchy (Organization). Manual processes (like Option D) are rarely correct in cloud governance questions where automation and centralization are key. Always verify if a policy propagates downwards when placed at the root.

Frequently Asked Questions

Why is Option D not a valid solution?

Relying on manual configuration by multiple teams is error-prone and cannot be enforced programmatically. Cloud governance requires automated, policy-driven controls to ensure consistency.

Does an Organization Policy at the root affect existing projects?

Yes. Organization Policies set at the root organization node propagate down to all child folders, projects, and resources, both existing and newly created.

More CDL FAQ →

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 24 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 24

  1. Swollenbadger 👍 4 Answered A
    I chose A because this type of rule would likely only make sense at the organization level (org > folder > project > resource).
  2. mb0812 👍 4
    Should be A
  3. cookieMr 👍 3 Answered A
    To ensure consistency and compliance across your organization, enforce Organization Policies that restrict VMs from having external IP addresses. Organization Policies provide centralized control and can prevent users from creating VM instances with external IP addresses across different projects and folders within your organization.
  4. Monicaarg 👍 3 Answered A
    Because is expected that different teams will create new folders and projects in the near future. Then the restriction must be ver folders.
  5. ucsdmiami2020 👍 3 Answered A
    Refer to Google Docs explanation of Resource hierarchy, https://cloud.google.com/resource-manager/docs/cloud-platform-resource-hierarchy
Show 19 more comments
  1. Shashank_R 👍 3
    A is the Answer ; root organization node is the key here to restrict virtual machine instances from having an external IP address.
  2. Pou1ze 👍 3 Answered A
    the sentence that say "in the future other team create new project...." address the answer at the top level of hierarchy
  3. erwin_t82 👍 2 Answered A
    The Organization Policy Service gives you centralized and programmatic control over your organization's cloud resources. As the organization policy administrator, you will be able to configure constraints across your entire resource hierarchy.
  4. akshay_jadhav 👍 2 Answered A
    It has to A because giving Organisation level policy is the optimum choice
  5. grzeev 👍 2
    A. projects and resources inherits from root!
  6. jres 👍 2
    A very true. this solve the problem
  7. Surek 👍 2
    Answer is A
  8. star2anand 👍 1
    A. Define an organization policy at the root organization node to restrict virtual machine instances from having an external IP address
  9. Waffle0906 👍 1 Answered A
    Organization level control for existing & future folders
  10. gireeshbengeri 👍 1 Answered A
    Video rendering can fetch by Premptible with low cost
  11. NU_1234 👍 1 Answered A
    Addressing at root level through policy
  12. tsk9921 👍 1
    A Root level will address the issue
  13. lzuccolo 👍 1 Answered A
    Configurar a nivel raiz las ips
  14. Sp4nner 👍 1 Answered A
    Root is above all
  15. SrR97 👍 1 Answered A
    A es correcto
  16. __rajan__ 👍 1 Answered A
    A is correct.
  17. chai_gpt 👍 1 Answered A
    A is correct
  18. mdsarfraz69 👍 1 Answered A
    Answer is A.
  19. haroldbenites 👍 1
    Go for A

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Public Cloud Provider Ownership in Shared Responsibility Model

S-grade

Google Cloud Data Lake vs Data Warehouse Selection

S-grade

Migrating Private Cloud Hypervisor Workloads to Google Cloud

S-grade

Strategic Data Analysis Service for Petabytes

S-grade

Practice All CDL Questions

Access 84 questions with complete answers and detailed explanations.

View Full CDL Practice Test →

← Back to CDL Study Guide