mediumMultiple ChoiceObjective-mapped
Google ACE Practice Question: Ensure that all IAM users in a project must use…
A company wants to ensure that all IAM users in a project must use two-factor authentication. Which Google Cloud service should be used?
⚠ Common exam trap
Many exam-takers confuse Cloud IAM (which handles authorization) with Cloud Identity (which handles authentication and MFA enforcement), leading them to incorrectly select Cloud IAM because they think 'IAM' covers all identity-related settings.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Identity
Cloud Identity is the correct service because it provides identity-as-a-service (IDaaS) that allows administrators to enforce security policies, including requiring two-factor authentication (2FA) for all IAM users. By enabling 2FA at the Cloud Identity level, every user authenticating through Google Cloud's identity layer must complete a second factor (e.g., TOTP via Google Authenticator or a security key) before accessing any Google Cloud resources. This policy applies globally across all projects in the organization, ensuring consistent enforcement without needing to configure per-user or per-project settings.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Cloud Identity
Why this is correct
Cloud Identity is the correct choice because it is Google's Identity-as-a-Service (IDaaS) solution that centrally manages user accounts, groups, and security policies for a project. It provides features like two-step verification (2SV), single sign-on (SSO), and session management, which directly enforce authentication security for IAM users. As the identity provider for Cloud Platform, it ensures that only properly authenticated and policy-compliant users can access project resources.
- ✗
Identity Platform
Why it's wrong here
Identity Platform is not the right service here because it is designed as a customer identity and access management (CIAM) platform for building authentication into external-facing applications. It allows developers to add sign-up and sign-in methods (e.g., social logins, email/password) for end users of an app, not for managing internal IAM users of a Google Cloud project. It does not govern the identity lifecycle of employees or provide the organizational security policies like 2SV that apply to project IAM members.
- ✗
Cloud IAM
Why it's wrong here
Cloud IAM is focused exclusively on authorization—controlling which principals have which roles and permissions on Google Cloud resources—not on authentication or user management. While IAM policies can define who can access a project, they do not enforce security measures like multi-factor authentication, password policies, or session lifetimes for those users. IAM relies on the identity provider (such as Cloud Identity) to authenticate users, so it cannot fulfill the requirement to ensure security policies like 2SV are applied to all IAM users.
- ✗
Cloud Audit Logs
Why it's wrong here
Cloud Audit Logs only records administrative and data-access activities for audit, compliance, and forensics purposes, but it never enforces or manages security policies. It captures who did what, when, and from where, enabling you to monitor for suspicious behavior after the fact, yet it has no mechanism to require 2SV or to block unauthenticated or policy-violating users. Thus, it is a monitoring tool, not a preventive control for ensuring authentication security across all IAM users.
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
Key term
Google Cloud
Google Cloud is a suite of cloud computing services offered by Google that provides infrastructure, platform, and software solutions over the internet.
About these practice questions
This ACE question is part of Courseiva's 769-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.