Professional Cloud Security EngineerDemo

Question

Your company must comply with industry-specific regulations. Therefore, you need to enforce customer-managed encryption keys (CMEK) for all new Cloud Storage resources in the organization named org1.

Which command should you run?

A • organization poli-cy:constraints/gcp.restrictStorageNonCmekServices• binding at: org1• policy type: allow• policy value: all supported services
B • organization policy: con-straints/gcp.restrictNonCmekServices• binding at: org1• policy type: deny• policy value: storage.googleapis.com
C • organization policy: con-straints/gcp.restrictStorageNonCmekServices• binding at: org1• policy type: deny• policy value: storage.googleapis.com
D • organization policy: con-straints/gcp.restrictNonCmekServices• binding at: org1• policy type: allow• policy value: storage.googleapis.com

Explanation

To require CMEK, configure the list constraint constraints/gcp.restrictNonCmekServices with a Deny policy for storage.googleapis.com. This prevents new Cloud Storage resources from being created without a customer-managed encryption key; binding the policy at org1 applies the requirement across the organization.

Learn more

CMEK organization policies

Professional Cloud Security EngineerDemo

AstroTutor

Notes

Readiness

QuestionQ300

Community Discussion