Exam Professional Cloud Security Engineer topic 1 question 52 discussion

I think Ans is AD Because we need to stop the users can create project first (A), and allow devops team to create project (D)

AD is the answer. If constraint is added , no project creation will be allowed, hence B is wrong

E. I think that the billing account creator role is needed in this case. https://cloud.google.com/resource-manager/docs/default-access-control#removing-default-roles "After you designate your own Billing Account Creator and Project Creator roles, you can remove these roles from the organization resource to restrict those permissions to specifically designated users. "

"A,D" seems most accurate. The following page talks about how Project Creator role is granted to all users by default, which is why "A" is necessary. And then there's a section about granting Project Creator to specific users which is where "D" comes in. https://cloud.google.com/resource-manager/docs/default-access-control#removing-default-roles

AD is perfect. A. Remove all users from the Project Creator role at the organizational level. D. Add a designated group of users to the Project Creator role at the organizational level.

A. Remove all users from the Project Creator role at the organizational level. D. Add a designated group of users to the Project Creator role at the organizational level. https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints

https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints I see no way to restrict project creation with an organizational policy. If that would have been possible I would have voted for it as restrictions can be overriden in GCP.

Seems to be AC When an organization resource is created, all users in your domain are granted the Billing Account Creator and Project Creator roles by default. As per the link https://cloud.google.com/resource-manager/docs/default-access-control#removing-default-roles Hence A is definitely the answer. Now to add the project creator we need to add the designated group to the project creator role specifically.

ad of course

Ans AC also

Ans : AD

A & D is the right answer.

Ans - AD

I think AC. Because, a role is granted to user/group, rather user/group is added to a role.

AD is the answer. There's nothing related to project creation in organization policy constraints.