Cloud Digital Leader Trust and security with Google Cloud Practice Question

A security engineer notices that a Compute Engine instance is running a VM with a public IP that should not be accessible from the internet. They want to ensure this configuration is prevented by default for all future projects in the organization. What should they do?

⚠ Common exam trap

Watch out — candidates often confuse IAM policies with Organization Policies, thinking that IAM can restrict resource configurations (like public IPs) when it only controls who can perform actions, not the attributes of the resources created.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Define an Organization Policy with the constraint compute.vmExternalIpAccess

Organization Policies in Google Cloud allow you to set constraints at the organization, folder, or project level to enforce security controls. The `compute.vmExternalIpAccess` constraint specifically prevents VMs from being created with external IP addresses, ensuring that no future Compute Engine instances in the organization can have public IPs by default. This is a preventive control that applies to all new VM creations, unlike IAM policies or firewall rules which are more granular or reactive.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Set an IAM policy to deny compute.instances.create with public IP
Why it's wrong here
IAM policies grant or deny permissions on specific API methods such as compute.instances.create, but there is no separate IAM permission for 'create with public IP.' The presence of an external IP is an attribute of the request payload, not a distinct resource-level permission, so a deny rule cannot condition on it. Even a custom IAM role cannot inspect request fields; IAM evaluates identity and resource type, not configuration values like public IP assignment.
✓
Define an Organization Policy with the constraint compute.vmExternalIpAccess
Why this is correct
The Organization Policy constraint compute.vmExternalIpAccess is a list constraint that can be applied at the organization, folder, or project level to explicitly block the creation of Compute Engine VMs with external IP addresses. This is a preventive, infrastructure-level guardrail enforced by the Resource Manager at request time, regardless of the IAM roles held by the caller. It can be configured to deny all external IPs or to allow only a set of specific IP ranges, and it propagates hierarchically to all child resources.
✗
Create a VPC firewall rule to deny all traffic from the internet to the VM
Why it's wrong here
VPC firewall rules operate at the network layer, filtering packets after a VM has already been created with a public IP. A deny rule from 0.0.0.0/0 would block inbound internet traffic, but the VM would still be assigned a public IP address and could initiate outbound connections, potentially enabling data exfiltration. This is a reactive control that mitigates exposure but does not prevent the misconfiguration itself, so it fails to satisfy a requirement to prevent public IP assignment entirely.
✗
Use Cloud Security Scanner to identify and remediate
Why it's wrong here
Cloud Security Scanner is a web application vulnerability scanner designed to crawl deployed applications for issues like cross-site scripting (XSS) and mixed content on App Engine, Compute Engine, and GKE endpoints. It does not evaluate cloud configuration, IAM policies, or organizational constraints, and it cannot alter infrastructure settings. Additionally, it only operates after a workload is already deployed, making it useless for preventing the creation of VMs with public IPs during the resource provisioning phase.

Go deeper

Cloud Digital Leader Trust and security with Google Cloud Practice Question

Why each option matters

Option-by-option breakdown

Related to this question