A research institute's security policy forbids any virtual machine in its Google Cloud organization from being assigned a public IP address. Which mechanism enforces this across all current and future projects?
Show answer and explanation
Answer: C
The vmExternalIpAccess organization policy constraint can be set to deny external IP addresses on VM instances. Applied at the organization level, it flows down to every folder and project, and it blocks the assignment at instance creation, so no VM can launch with a public address. Egress firewall rules affect traffic but leave the address assigned. Removing a role only changes who can edit networking, and Cloud NAT gives private instances outbound access without preventing public addressing.
Why the other options are wrong
- A. Egress firewall rules can block outbound traffic, but the VM still has an external address and can still be reached by any inbound path that is allowed. The address assignment itself is not prevented.
- B. Revoking a role from users does not stop future creation by others who hold the same role elsewhere, and it does not establish a preventive guardrail across all projects.
- D. Cloud NAT gives private instances outbound internet access without external IPs, which is useful alongside the control. However, it does not stop VMs from being assigned external addresses.