mediumMultiple ChoiceObjective-mapped
Google ACE Practice Question: A platform team needs to categorize GCP resources…
A platform team needs to categorize GCP resources for policy enforcement (e.g., applying IAM conditions only to resources tagged 'environment:production'). Labels exist but don't support IAM conditions. What feature provides policy-tag-based enforcement?
⚠ Common exam trap
Google Cloud often tests the distinction between resource labels and Resource Manager Tags, trapping candidates who assume labels can be used in IAM conditions because they are more commonly used for resource organization.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Resource Manager Tags — attach a tag with key 'environment' and value 'production' and reference it in IAM conditions
Resource Manager Tags are the GCP feature specifically designed to support IAM conditions for policy enforcement. Unlike resource labels, which are simple key-value pairs used for metadata and billing, Resource Manager Tags can be referenced in IAM condition expressions using the `resource.matchTag` function, enabling fine-grained access control based on tag values such as 'environment:production'.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Resource labels — set environment=production on each resource and reference in IAM conditions
Why it's wrong here
Labels are free-form metadata used for billing, cost allocation, and basic resource categorization, but they are deliberately excluded from IAM Condition expressions by design. IAM Conditions only support `resource` attributes such as name, type, service, and Resource Manager Tags (via `resource.getTagKeys()`/`getTagValue()`), so a condition referencing labels would not be validated and would cause policy errors or be silently ignored. Thus, labels cannot implement the required environment-based access control.
- ✓
Resource Manager Tags — attach a tag with key 'environment' and value 'production' and reference it in IAM conditions
Why this is correct
Resource Manager Tags are hierarchical key-value pairs that can be attached to projects, folders, and individual resources such as Compute Engine instances. When a tag with key 'environment' and value 'production' is attached, it becomes visible in IAM policy binding conditions through the `resource.getTagKeys()` and `resource.getTagValue()` functions, enabling attribute-based access control. This approach is declarative, preventive, and evaluated at every API request, so it correctly fulfills the requirement to allow access only to production resources.
- ✗
Cloud Asset Inventory metadata fields — query by label and apply policies
Why it's wrong here
Cloud Asset Inventory is a metadata discovery and audit service that records the state, history, and relationships of cloud resources, but it is not an IAM policy enforcement point. Querying it by labels or metadata can produce inventory reports and trigger downstream workflows, but it cannot evaluate IAM Conditions at request time or enforce access based on those metadata values. Therefore, it fails to provide the required attribute-based access control because it lacks a real-time evaluation mechanism.
- ✗
Pub/Sub event-driven policy application triggered by label changes
Why it's wrong here
Pub/Sub event-driven policy management would require a separate pipeline to detect label changes, invoke a policy-updating function, and propagate new bindings — an asynchronous, eventual-consistency model that cannot guarantee instant enforcement. This approach is reactive and complex, and during the propagation window a resource could be misclassified, leading to either over-permissioning or lockout. In contrast, Resource Manager Tags with IAM Conditions deliver synchronous, static enforcement without any moving infrastructure.
Go deeper
Related to this question
About these practice questions
Courseiva writes every ACE question from scratch — 769 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.