PCSE Practice Question: Configuring Access Within a Cloud Solution Environment

Correct answer & explanation

Use an organization-level deny policy with the constraint constraints/iam.disableServiceAccountKeyCreation set to deny, and then a project-level allow policy override. However, deny policies override allow policies by default. To allow in a specific project, you can use a project-level deny policy that allows (i.e., not deny) or use an organization policy with an exception using the 'grantedValues' or 'allowedValues'? Actually, the constraint is a boolean constraint; you cannot have exceptions. The correct approach is to use a deny policy at the organization level that denies the iam.serviceAccountKeys.create permission, and then create a deny policy at the project level that allows that permission (i.e., not deny). But deny policies are evaluated together; the most specific policy wins? Actually, deny policies are hierarchical and deny is deny; you cannot allow via deny. The proper way is to use an organization policy (constraint) that disables key creation, and then use a policy exception at the folder or project level using the 'allowedValues' or 'deniedValues'? For boolean constraints, you cannot set exceptions; you have to use a different constraint. The correct answer is to use an organization policy with constraints/iam.disableServiceAccountKeyCreation set to 'True' at the org, and then create a custom constraint at the project level that allows? No, custom constraints don't override boolean constraints. The recommended approach is to use a deny policy (v2) at the organization level that denies the permission, and then create a deny policy at the project level that allows the permission by not denying it. But deny policies are hierarchical; the most specific (project-level) deny policy can allow if it doesn't include the deny rule? Actually, deny policies can include 'denial_condition' and 'exception_principals'. You can set an exception for the specific project's service accounts. The correct answer: Use an organization policy with constraints/iam.disableServiceAccountKeyCreation = True, then create a project-level policy that overrides it? But boolean constraints don't support override. The correct approach is to use a deny policy with an exception for the project. So I'll go with option D.

Key principle: ACLs process entries top to bottom and stop at the first match. Entry order and interface direction matter as much as the permit or deny statement.