mediumMultiple ChoiceObjective-mapped
Google ACE Practice Question: Enforce that all new Cloud Storage buckets in…
You need to enforce that all new Cloud Storage buckets in your organization use Uniform Bucket-Level Access (UBLA) and are created in one of three approved regions: `us-central1`, `us-east1`, or `europe-west1`. What is the most efficient way to enforce both constraints?
⚠ Common exam trap
Google Cloud often tests the distinction between preventive controls (organization policies) and detective/reactive controls (Cloud Functions, Terraform validation), and the trap here is assuming that a post-creation check or a tool-specific validation is sufficient when a native, pre-creation enforcement mechanism exists.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply `storage.uniformBucketLevelAccess` and `gcp.resourceLocations` org policies at the organization level.
Organization policies are the most efficient way to enforce constraints across all new Cloud Storage buckets because they are evaluated at resource creation time by the Cloud Resource Manager. The `storage.uniformBucketLevelAccess` policy enforces UBLA, and `gcp.resourceLocations` restricts the allowed locations, both applied at the organization level to cover all projects without per-bucket overhead.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Write a Cloud Function triggered by bucket creation events to check and delete non-compliant buckets.
Why it's wrong here
Reactive enforcement allows non-compliant buckets to be created before deletion, creating a window of exposure and potential data loss.
- ✓
Apply `storage.uniformBucketLevelAccess` and `gcp.resourceLocations` org policies at the organization level.
Why this is correct
These two org policy constraints enforce UBLA and region restrictions declaratively at creation time — no buckets outside the policy are ever created.
- ✗
Create a custom IAM role that removes the `storage.buckets.create` permission for disallowed regions.
Why it's wrong here
IAM roles cannot distinguish regions in their permission grants; region enforcement requires org policies, not IAM.
- ✗
Use Terraform to provision all buckets and include validation in the Terraform plan step.
Why it's wrong here
Terraform plan validation only applies to Terraform-managed resources; it does not prevent out-of-band bucket creation by developers with direct access.
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
Cloud storage
Cloud storage is a service that lets you save data on remote servers accessed over the internet instead of on your computer's hard drive.
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
About these practice questions
Courseiva writes every ACE question from scratch — 769 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.