hardMultiple ChoiceObjective-mapped
Google ACE Practice Question: A team runs a critical production project and…
A team runs a critical production project and wants to prevent anyone — including project owners and organization admins — from accidentally deleting it. Which mechanism provides this protection?
⚠ Common exam trap
Candidates often confuse IAM permissions (like denying `resourcemanager.projects.delete`) with project-level operational locks (liens), or assume a UI toggle exists for deletion protection when it does not in Google Cloud.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a project lien using the Cloud Resource Manager API or gcloud
A project lien is the correct mechanism because it explicitly prevents the deletion of a Google Cloud project by blocking the `resourcemanager.projects.delete` operation until the lien is removed. This protection works regardless of the user's role, including project owners and organization admins, and is managed via the Cloud Resource Manager API or `gcloud` command. It is designed specifically for accidental deletion prevention, not for access control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Remove the Owner role from all users in the project
Why it's wrong here
Removing the Owner role from all users does not prevent project deletion because users with the resourcemanager.projects.delete permission (such as organization administrators) can still delete the project from the organization level. Additionally, removing Owner roles would disrupt normal project administration, as no user would retain the ability to manage IAM policies or perform privileged operations. This action fails to block deletion and creates operational risk.
- ✗
Set an organization policy denying the resourcemanager.projects.delete permission
Why it's wrong here
Organization policies in GCP use pre-defined constraints (e.g., constraints/compute.disableSerialPort) to restrict resource configurations, but they cannot deny specific IAM permissions like resourcemanager.projects.delete. IAM permissions are controlled via IAM roles and deny policies, not through organization policy constraints. A boolean org policy cannot target a resource manager API method for denial, so this approach is not technically valid.
- ✓
Create a project lien using the Cloud Resource Manager API or gcloud
Why this is correct
Creating a project lien is the correct way to prevent accidental or even intentional deletion of a project. A lien blocks the resourcemanager.projects.delete operation on the project, and any deletion attempt will fail until the lien is removed via the Cloud Resource Manager API or using the 'gcloud resource-manager liens' commands, even for users who have the delete permission. This is the only option that directly and reliably protects the project from deletion.
- ✗
Enable deletion protection in the project's IAM settings in the Console
Why it's wrong here
There is no 'deletion protection' toggle in the GCP Console's IAM settings. Project deletion protection is implemented exclusively through project liens, which are managed using the Cloud Resource Manager API or the gcloud resource-manager liens command, not through any Console IAM dashboard. Console IAM settings only manage members and roles for a project.
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
Google Cloud project
A Google Cloud project is a container that holds all your cloud resources like virtual machines, databases, and storage, acting as the main building block for organizing and managing everything you do in Google Cloud.
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
About these practice questions
Courseiva writes every ACE question from scratch — 769 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.