hardMultiple ChoiceObjective-mapped
Google ACE Practice Question: Policy at the organization level sets…
An organization policy at the organization level sets `constraints/compute.requireOsLogin` to enforced (true) on all projects. A specific project needs an exception — VMs there should not require OS Login. How can this exception be configured?
⚠ Common exam trap
Google Cloud often tests the misconception that organization policies are absolute and cannot be overridden at lower levels, but many boolean constraints explicitly allow per-project or per-folder overrides when configured correctly.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set a project-level organization policy overriding `compute.requireOsLogin` to not enforced (if the constraint allows override)
Organization policies can be overridden at a lower level (project, folder) if the constraint's `inheritFromParent` setting allows it. The `compute.requireOsLogin` boolean constraint supports per-project override, so setting it to `false` at the project level exempts that project's VMs from requiring OS Login while the organization-level policy remains enforced for all other projects.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Removing the VM from the VPC will bypass the organization policy
Why it's wrong here
Removing a VM from a VPC network has no impact on organization policy enforcement because `compute.requireOsLogin` is evaluated based on the project's resource hierarchy, not on network membership. Organization policies are applied to projects and VMs at the project level, and a VM's network is irrelevant to whether OS Login is required. The policy still applies to all VMs in the project, regardless of VPC configuration.
- ✓
Set a project-level organization policy overriding `compute.requireOsLogin` to not enforced (if the constraint allows override)
Why this is correct
The correct approach is to set a project-level organization policy for `compute.requireOsLogin` with the 'not enforced' status, provided the constraint's inheritance allows per-project overrides. This creates an exception that overrides the inherited org-level policy, allowing new VM instances in that project to be created without OS Login enabled. However, the org policy must still permit the override; if the constraint is locked with a custom value, the org administrator may need to adjust the policy hierarchy.
- ✗
Grant the VM's service account the OS Login Admin role to bypass the policy
Why it's wrong here
Granting the VM's service account the OS Login Admin role does not affect the `compute.requireOsLogin` organization policy. The OS Login Admin role (roles/oslogin.admin) is an IAM role that manages OS Login settings for users, but IAM roles do not override organization policy enforcement. The constraint applies to all VM instances in the project, so the policy remains enforced regardless of the service account's permissions.
- ✗
Move the project to a folder that doesn't inherit the organization policy
Why it's wrong here
Moving the project to another folder within the organization does not bypass an organization-level policy because organization policies are inherited by all folders and projects below the node where they are set. Unless the new folder contains an explicit policy override that sets `compute.requireOsLogin` to not enforced, the original org-level policy still applies. Since the policy is defined at the organization node, changing folders has no effect on inheritance.
Go deeper
Related to this question
Learn chapter
Google Compute Engine
Key term
Folder
A folder is a logical container used to organize and group digital files, resources, or cloud-based assets within a system or platform.
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
About these practice questions
This ACE question is part of Courseiva's 769-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.