Answer-first summary for fast verification
Answer: A project level, the organizational policy control has been overwritten with an "allow" value.
The correct answer is C because organizational policies in Google Cloud can be overridden at lower levels in the resource hierarchy. If a folder-level policy denies external IP assignment but a project-level policy explicitly allows it, the project-level policy takes precedence, allowing the VM creation. This is supported by the community discussion where multiple comments with higher upvotes (e.g., MisterHairy with 2 upvotes, Xoxoo with 3 upvotes) explain that project-level overrides can permit external IPs despite folder-level restrictions. Option A is incorrect because organizational policies are not retroactive for existing resources, but the question specifies a 'new VM' created after the policy was set, so the policy should have prevented external IP assignment unless overridden. Option B is less suitable as 'dry run' mode is a preview feature and not typically the default or most common cause; while mentioned in the discussion (MoAk with 3 upvotes), it is not the primary reason based on standard policy enforcement. Option D is incorrect because, according to Google's policy hierarchy, a deny at a lower level (folder) would not be overridden by an allow at a higher level (organization) if the folder policy is explicitly set; the discussion (vividg with 4 upvotes) notes that 'DENY takes precedence' in policy conflicts, making D implausible.
Author: LeetQuiz Editorial Team
Ultimate access to all questions.
No comments yet.
You have defined central security controls in your Google Cloud environment. For a specific folder in your organization, you set an organizational policy to deny the assignment of external IP addresses to VMs. Two days later, you receive an alert that a new VM with an external IP address was created in that folder.
What is the most likely reason this alert was generated?
A
The VM was created with a static external IP address that was reserved in the project before the organizational policy rule was set.
B
The organizational policy constraint wasn't properly enforced and is running in "dry run" mode.
C
A project level, the organizational policy control has been overwritten with an "allow" value.
D
The policy constraint on the folder level does not have any effect because of an "allow" value for that constraint on the organizational level.