hardMultiple ChoiceObjective-mapped
Google ACE Practice Question: A company has multiple projects under an…
A company has multiple projects under an organization. They want to enforce that all service accounts created in any project must use the naming prefix 'sa-'. Which policy should be used?
⚠ Common exam trap
Google Cloud often tests the distinction between 'enforcement' (organization policies) and 'monitoring' (audit logs) or 'access control' (IAM conditions), leading candidates to confuse a naming convention policy with a logging or access control mechanism.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Organization policy using a custom constraint
An organization policy with a custom constraint is the correct approach because it allows you to define a specific rule (e.g., all service accounts must start with 'sa-') that is enforced across all projects in the organization. Custom constraints use the Resource Manager API's `constraints/*` format and are evaluated at resource creation time, making them ideal for naming conventions that must be applied universally.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
VPC Service Controls
Why it's wrong here
VPC Service Controls define security perimeters around Google Cloud services to prevent data exfiltration and restrict access to protected services. They operate at the service and policy level, not on resource names, so they cannot enforce a naming convention across projects. Even though they can block access to a resource after it exists, they offer no mechanism to require or validate a specific naming pattern at creation time.
- ✓
Organization policy using a custom constraint
Why this is correct
An organization policy with a custom constraint is the correct answer because it can enforce resource naming patterns at the resource creation step. By defining a custom constraint with a CEL condition that checks the resource name against a regex (for example, `resource.name.matches('^[a-z]+[-][0-9]+$')`), the policy rejects any project that does not conform. This policy applies hierarchically across all projects under the organization, making it a proactive, centralized, and enforceable naming governance control.
- ✗
Project-level IAM condition
Why it's wrong here
Project-level IAM conditions control access to a resource based on attributes like resource name, but they do not enforce naming patterns on the resources themselves. An IAM condition can restrict who can use a Permissions, such as `resourcemanager.projects.create` when a name matches a pattern, but it cannot automatically require or enforce that pattern for every project created by all users. It is a conditional authorization mechanism, not a declarative policy on resource properties, so it is not designed for naming governance.
- ✗
Cloud Audit Logs
Why it's wrong here
Cloud Audit Logs record actions and changes in Google Cloud, providing visibility into who did what and when, but they are purely passive. They do not block or enforce resource creation; they only generate log entries after the fact. While audit logs could be used to detect non-compliant names post-creation, they cannot prevent or require a naming pattern, making them a monitoring tool rather than a policy enforcement mechanism.
Go deeper
Related to this question
Learn chapter
Deployment Manager and Terraform on GCP
Key term
Service
A service is a software component or system that performs a specific function and is available to be used by other programs or users over a network.
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
About these practice questions
This ACE question is part of Courseiva's 769-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.