Google ACE Practice Question: Ensure that only users from a specific domain…

A company wants to ensure that only users from a specific domain (@example.com) can access Cloud Storage buckets in a project. Which two steps should be taken? (Choose two.)

⚠ Common exam trap

Google Cloud often tests the distinction between organization policies (which enforce constraints globally at the resource hierarchy level) and IAM conditions (which are per-binding and evaluated at access time), leading candidates to incorrectly choose IAM conditions as a domain restriction mechanism.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Set an organization policy to restrict allowed domains for IAM.

The organization policy constraint `iam.allowedPolicyMemberDomains` restricts which domains can be used as members in IAM policies across the entire project. This ensures that only principals from @example.com can be granted access to any resource, including Cloud Storage buckets. Option E is correct because a Cloud Identity group containing only @example.com users can be granted IAM roles on the bucket, and membership in the group is controlled by the domain, effectively limiting access to that domain.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Use VPC Service Controls to restrict access.
Why it's wrong here
VPC Service Controls restricts only the network context from which access occurs, using service perimeters to block data exfiltration; it does not inspect the IAM identity's domain. A user from a non-example.com domain could still be granted permissions via IAM, so this does not satisfy the requirement.
✗
Enable domain restricted sharing in Cloud Storage settings.
Why it's wrong here
There is no "domain restricted sharing" toggle in Cloud Storage settings. Cloud Storage IAM lets you bind roles to specific principals like user:alice@example.com, but it does not provide a global bucket-level restriction on which domains appear in policies; only Organization Policies can enforce domain allow-lists centrally.
✓
Set an organization policy to restrict allowed domains for IAM.
Why this is correct
The organization policy constraint iam.allowedPolicyMemberDomains is the canonical mechanism to restrict which domains can be granted IAM roles. When this constraint lists example.com, any attempt to add a principal outside that domain to a bucket policy, project, or folder is rejected. Because it is inherited from the organization, it protects all resources under that hierarchy without per-resource configuration.
✗
Add an IAM condition to the bucket policy to require that the user's domain is @example.com.
Why it's wrong here
IAM conditions for bucket IAM policies cannot directly evaluate a user's email domain using a standard condition key such as principal.domain; condition attributes focus on resources, tags, and certain request properties, not the caller's domain suffix. Even with complex custom conditions, this approach would still allow an administrator to grant access to external domains, making it less reliable than the centralized organization policy.
✓
Grant access to the bucket to a Cloud Identity group that only includes @example.com users.
Why this is correct
Creating a Cloud Identity group that is populated only with users from example.com and granting the group a Storage role on the bucket leverages group membership as a proxy for domain verification. Only example.com users can be members if group membership is domain-restricted, so the access boundary holds. This is a valid complementary identity-centric solution but requires ongoing group membership management; the organization policy is the global, enforceable control.

Go deeper

Google ACE Practice Question: Ensure that only users from a specific domain…

Why each option matters

Option-by-option breakdown

Related to this question