Google ACE Setting Up a Cloud Solution Environment Practice Question
An engineer wants to ensure that no one in their organization can create VMs with public IP addresses. Which Google Cloud tool should they use to enforce this restriction?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Organization policies
Organization policies (Org Policies) allow setting constraints at the organization, folder, or project level to restrict configurations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Organization policies
Why this is correct
Organization policies are the correct tool because they directly enforce restrictions on resource configurations across the entire hierarchy (folders and projects). For example, the compute.vmExternalIpAccess constraint can be set to only allow certain VMs to have external IPs, or require a dedicated VPC peering. They act as guardian rules that cannot be overridden by users without the necessary admin permissions.
- ✗
Labels
Why it's wrong here
Labels are metadata key-value pairs attached to resources, used primarily for grouping, cost allocation, and operational filtering. They are non-enforced annotations and do not influence whether a configuration like a public IP is permitted. Even if a label says 'no-public-ip', it remains purely informational and does not block resource creation.
- ✗
IAM roles
Why it's wrong here
IAM roles control who can perform actions (like compute.instances.create) on specific resources, but they do not constrain the attributes of those actions. A user with compute.instanceAdmin can create VMs but the role does not conditionally restrict whether external IPs are allowed; that requires an organization policy to inspect and reject the request. IAM is about authorization, not configuration validation.
- ✗
Quotas
Why it's wrong here
Quotas limit the quantity of resources your project can consume, such as a maximum number of VM instances or total CPU cores. They do not assess or restrict the configuration choices within those resources, such as attaching a public IP address or using a specific disk type. Quotas are capacity thresholds, not architectural or security guardrails.
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
Google Cloud
Google Cloud is a suite of cloud computing services offered by Google that provides infrastructure, platform, and software solutions over the internet.
Key term
Folder
A folder is a logical container used to organize and group digital files, resources, or cloud-based assets within a system or platform.
About these practice questions
One of 769 original ACE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.