mediumMultiple Choice
Google ACE Practice Question: Enforce that all new Cloud Storage buckets in…
You need to enforce that all new Cloud Storage buckets in your organization use Uniform Bucket-Level Access (UBLA) and are created in one of three approved regions: `us-central1`, `us-east1`, or `europe-west1`. What is the most efficient way to enforce both constraints?
⚠ Common exam trap
Google Cloud often tests the distinction between preventive controls (organization policies) and detective/reactive controls (Cloud Functions, Terraform validation), and the trap here is assuming that a post-creation check or a tool-specific validation is sufficient when a native, pre-creation enforcement mechanism exists.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply `storage.uniformBucketLevelAccess` and `gcp.resourceLocations` org policies at the organization level.
Organization policies are the most efficient way to enforce constraints across all new Cloud Storage buckets because they are evaluated at resource creation time by the Cloud Resource Manager. The `storage.uniformBucketLevelAccess` policy enforces UBLA, and `gcp.resourceLocations` restricts the allowed locations, both applied at the organization level to cover all projects without per-bucket overhead.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Write a Cloud Function triggered by bucket creation events to check and delete non-compliant buckets.
Why it's wrong here
A Cloud Function reacts after the bucket exists, so a non-compliant bucket is briefly created and usable before deletion, and it cannot alter region or UBLA. It is tempting because event-driven remediation is a recognised pattern, but preventive enforcement needs an organisation policy constraint.
- ✓
Apply `storage.uniformBucketLevelAccess` and `gcp.resourceLocations` org policies at the organization level.
Why this is correct
Organization policies enforce constraints across all projects without per-bucket configuration. The `storage.uniformBucketLevelAccess` boolean constraint forces UBLA on every new bucket, while `gcp.resourceLocations` restricts creation to the three approved regions, satisfying both requirements centrally at the organization level.
- ✗
Create a custom IAM role that removes the `storage.buckets.create` permission for disallowed regions.
Why it's wrong here
IAM permissions do not vary by region, so storage.buckets.create cannot be scoped to us-central1, us-east1 or europe-west1; the role would block creation everywhere or nowhere. It is tempting because IAM controls who can act, but location and UBLA constraints belong to organisation policy.
- ✗
Use Terraform to provision all buckets and include validation in the Terraform plan step.
Why it's wrong here
Terraform validation only blocks non-compliant plans from pipelines that use it; buckets created via console, gcloud or other tooling bypass it entirely. It is tempting because Terraform is the standard provisioning tool, but enforcement requires an organisation policy constraint applied at the API layer.
Go deeper
Related to this question
Learn chapter
Access Transparency and Access Approval
Key term
Cloud storage
Cloud storage is a service that lets you save data on remote servers accessed over the internet instead of on your computer's hard drive.
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
About these practice questions
Courseiva writes every ACE question from scratch — 775 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.