Google ACE Setting Up a Cloud Solution Environment Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use Cloud Asset Inventory to monitor and alert on missing labels.

  Why it's wrong here

  Cloud Asset Inventory is a reactive monitoring and visibility tool. It can scan existing resources and alert when they lack required labels, but it never intercepts a create request to block the operation. At best, you could automate a remediation function, but by the time you detect the issue, the unlabeled resource already exists, so this meets compliance logging rather than enforcement.

• ✗

  Use IAM conditions to check labels at resource creation.

  Why it's wrong here

  IAM conditions are evaluated against properties of the resource being accessed, and during a create operation the resource doesn't yet exist to have labels queried. A condition that requires a label would reject all creation attempts because no label exists yet, making it useless for enforcing a standard. Moreover, IAM supports only a limited set of resource attributes (like name, service, type), not arbitrary nested label keys, so it cannot even express a 'must contain this label' rule.

• ✗

  Create a custom IAM role that denies creation without labels.

  Why it's wrong here

  A custom IAM role is simply a named collection of permissions, such as compute.instances.create. It cannot embed conditional logic that examines the request body for the presence of a label. Removing the create permission from the role would deny all creation requests, regardless of whether they include labels, which is overly drastic. Therefore, custom roles have no ability to enforce data-level validation like required labels.

• ✓

  Use an organization policy constraint to require labels.

  Why this is correct

  An organization policy custom constraint (e.g., a CEL-based constraint on the resource's `labels` field) is evaluated synchronously when a create or update request is made, and the request is rejected if the labels do not satisfy the rule. This is the only option that provides native, proactive enforcement at the API layer, preventing unlabeled resources from being created across supported GCP services. You can define it in the Resource Manager and attach it at the organization, folder, or project level.

Go deeper

Related to this question