GCP Security · Domain 5
Supporting Compliance Requirements
About 11% of the exam
Guardrails on the hierarchy
- Organization node
- policy applied to everything below
- Folder node
- policy for one business unit
- Project node
- policy for a single project
- Boolean constraint
- enforced or not at that node
- List constraint
- allowed or denied value list
- Inheritance
- inherited unless overriding is permitted
- Override control
- who may change policy below
- Policy viewer role
- reads policies without changing them
Set the constraint high in the hierarchy, then control tightly who is allowed to relax it further down
Constraint behavior
- Inherited policy enforces unless overridden
- Overriding needs the policy administrator role
- Several constraints must all be satisfied
- A denied creation appears in audit logs
- Enforcement blocks creation, not existing resources
- Restrict who holds policy administration
Custom and managed constraints
- Managed constraints ship with the platform
- Custom constraints target specific resource types
- Conditions written in an expression language
- Test at a small scope first
- Both apply together on one resource
- Name and describe them clearly
Safe policy change
- Dry run mode reports would-be violations
- Simulate access before removing a binding
- Peer review the change like code
- Roll out folder by folder
- Watch audit logs for new denials
- Document the exception and its expiry
Regulated workload programs
- Packaged controls for a regulatory regime
- Constraints applied automatically to the folder
- Creating out of scope resources is blocked
- Personnel access controls can be included
- Agreements still needed for regulated data
- Choose the regime before you build
Evidence sources
Configuration
- Asset inventory with change history
- Search across resources and policies
- Prove a bucket was never public
Access
- Role bindings at every node
- Administrative activity audit logs
- Data access logs where enabled
Posture
- Benchmark results in the console
- Posture drift detection over time
- Findings exported for the auditor
Benchmark control areas
Identity
- No static service account keys
- Least privilege instead of basic roles
- Separation of duties on keys
Network
- No open administrative ports
- Flow logging on subnets
- Private cluster control planes
Data
- Buckets not publicly readable
- Customer managed keys where required
- Retention and versioning configured
Residency and locality controls
- A location constraint pins resource creation
- Single region buckets for strict residency
- Key ring created in the same location
- Replication choices move data across borders
- A perimeter stops data leaving the boundary
- Support access can be geographically restricted
Transparency and justification
- Transparency logs record provider personnel access
- Justification codes explain why access happened
- The external key holder can refuse it
- Combine with confidential computing for separation
- Review the logs, do not merely enable
- Include them in the evidence pack
Cost and quota guardrails
- Quota
- a hard limit that blocks usage
- Budget
- alerts when spend crosses a line
- Budget action
- notification, not automatic shutdown
- Label
- attributes cost to a team
- Project separation
- clean cost and control boundary
- Unused resource
- recommender flags it for cleanup
- Log volume
- ingestion is a real cost
- Review
- cost and control reviewed together
Compliance mistakes
- Constraint set only on one project
- Policy administration granted too widely
- Evidence gathered manually at audit time
- Dry run findings never acted on
- Keys located outside the required region
- Exception with no owner or expiry
Service names to know
- Guardrails across the hierarchy
- organization policy constraints
- Packaged regulatory controls
- a regulated workload program
- Searchable configuration history
- asset inventory
- Benchmark posture checks
- security health analytics
- Test before enforcing
- dry run mode
- Explain an access decision
- the policy troubleshooter
- Provider personnel access
- access transparency logs
- Reason attached to key use
- access justifications
Know the order
- Choose the requirement
- Map to constraints
- Dry run
- Enforce high
- Evidence continuously
A program that produces evidence continuously turns the audit into a query instead of a project
Reference strip: guardrails, safety, evidence, residency, transparency
Guardrails
- Constraints at organization and folder
- Boolean and list constraints
- Custom constraints for your rules
- Control who may override
Safety
- Dry run before enforcement
- Simulate access changes
- Roll out gradually
- Exceptions with expiry dates
Evidence
- Asset inventory history
- Audit logs for access
- Benchmark results and drift
- Exports for the auditor
Residency
- Location constraint on creation
- Single region storage
- Key ring in the same place
- Perimeter stops the egress
Transparency
- Provider access recorded
- Justification reasons attached
- External key can refuse
- Reviewed, not merely enabled
Quick exam traps
- Trap: A constraint set at the project level cannot be overridden
- Trap: A regulated workload program removes the need for an agreement
- Trap: Enforcing a constraint deletes resources that already violate it
- Trap: Enabling transparency logs is the same as reviewing them
- Trap: Budgets automatically stop spending when the threshold is crossed
- Trap: Keeping data in a region also keeps the keys there
- Trap: A benchmark score is sufficient evidence of compliance
cybercertprep.com · original revision sheet written from the public body of knowledge