hardMultiple ChoiceObjective-mapped
Google ACE Practice Question: Set an organization policy that prevents any…
You need to set an organization policy that prevents any project from creating Cloud SQL instances with a public IP address. The constraint you need is `sql.restrictPublicIp`. What type of constraint is this, and how do you enable it?
⚠ Common exam trap
A common mix-up: candidates confuse boolean constraints with list constraints, thinking they need to specify denied values like IP ranges, when in fact the boolean constraint simply toggles enforcement on or off.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Boolean constraint — set `enforce: true` in the organization policy.
`sql.restrictPublicIp` is a boolean constraint in Google Cloud Organization Policies. Boolean constraints have a simple `enforce: true` or `enforce: false` setting, and setting it to `true` prevents projects from creating Cloud SQL instances with public IP addresses. This is the standard method to enforce this restriction across the organization.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
List constraint — add `CLOUD_SQL_INSTANCE` to the `deniedValues` list.
Why it's wrong here
This option is also based on the false premise that `sql.restrictPublicIp` accepts a list of values. In reality, `CLOUD_SQL_INSTANCE` is a resource type, not a value that can be added to a policy list. Boolean constraints like `sql.restrictPublicIp` apply directly to the Cloud SQL instance resource during creation or update; they do not use denied values to determine which resource types are affected. Therefore, adding `CLOUD_SQL_INSTANCE` to a nonexistent list is invalid and would not enforce the intent.
- ✓
Boolean constraint — set `enforce: true` in the organization policy.
Why this is correct
The `sql.restrictPublicIp` constraint is a boolean organization policy constraint, meaning it only has two states: enforced or not enforced. Setting `enforce: true` on this policy at the desired folder, project, or organization level actively blocks the assignment of public IPv4 addresses to any matching Cloud SQL instances within that scope. This is the native, supported mechanism for prohibiting public IP exposure and requires no additional values or expressions.
- ✗
Custom constraint — define a CEL expression that evaluates the Cloud SQL instance's IP configuration.
Why it's wrong here
While custom constraints with CEL expressions can override complex resource properties, defining one to inspect the instance's IP configuration is unnecessary because `sql.restrictPublicIp` already exists as a predefined boolean constraint. Custom constraints add maintenance overhead, require careful CEL syntax, and are meant for gaps in the predefined library. Using the out-of-the-box boolean constraint is simpler, less error-prone, and is the recommended practice for disallowing public IPs on Cloud SQL instances.
- ✗
List constraint — add `0.0.0.0/0` to the `deniedValues` list.
Why it's wrong here
This option incorrectly treats `sql.restrictPublicIp` as a list constraint, but Google Cloud defines it as a boolean constraint, so there is no `allowedValues` or `deniedValues` list to populate. Even if a hypothetical list constraint accepted IP ranges, specifying `0.0.0.0/0` would be nonsensical here because the constraint is not about filtering specific source networks; it is an outright ban on public IP assignment for the instance itself, not on client access ranges.
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
Cloud SQL
Cloud SQL is a fully managed relational database service that lets you set up, maintain, and scale SQL databases (like MySQL, PostgreSQL, and SQL Server) in the cloud without managing the underlying infrastructure.
Key term
Public IP address
A globally unique IP address assigned to a device that allows it to communicate directly over the internet.
About these practice questions
Courseiva writes every ACE question from scratch — 769 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.