hardMultiple ChoiceObjective-mapped
Google ACE Practice Question: Requires that all Compute Engine instances be…
An organization requires that all Compute Engine instances be created with a specific service account that has minimal permissions. They also want to prevent users from creating instances with a different service account. Which IAM policy should they implement?
⚠ Common exam trap
Candidates often confuse the organization policy constraint `compute.setServiceAccount` with the IAM permission `compute.instances.setServiceAccount`, thinking that restricting the permission is sufficient, when in fact the organization policy is required to block creation with unauthorized service accounts at the resource hierarchy level.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Organization policy with constraint compute.setServiceAccount
The organization policy constraint `compute.setServiceAccount` is the correct choice because it allows administrators to restrict which service accounts can be used when creating Compute Engine instances. By setting this constraint to only permit a specific service account, users are prevented from launching instances with any other service account, ensuring minimal permissions are enforced at the organization level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Organization policy with constraint compute.disableUserServiceAccountCreation
Why it's wrong here
This option refers to an organization policy constraint that does not exist in Google Cloud. The actual constraint for restricting service account usage is compute.setServiceAccount, which accepts a list of allowed service account emails. Since disableUserServiceAccountCreation is not a recognized constraint, it cannot be applied, and relying on it would not enforce any protection. Therefore this answer is incorrect.
- ✗
IAM condition that restricts instances to only use the authorized service account
Why it's wrong here
While an IAM condition can indeed restrict resource creation based on specific attributes, it's designed to *filter* requests based on existing attributes of the resource being created, not to *enforce* the use of a particular service account during the creation process itself. This option is tempting because IAM conditions are powerful for granular access control, and one might imagine they could dictate the service account used. However, the requirement here is to *prevent* the use of *any other* service account, which a condition on the `compute.instances.create` permission cannot directly enforce at the point of instance creation.
- ✗
Custom role with permission compute.instances.setServiceAccount only for authorized users
Why it's wrong here
Granting a custom role with compute.instances.setServiceAccount permission only allows a user to set or modify the service account on an instance; it does not limit which service account can be assigned. An authorized user could still attach any service account they can access, including unauthorized ones. To enforce a specific allowed set, you need an organization policy constraint such as compute.setServiceAccount that defines the permitted service accounts. Thus this option is insufficient.
- ✓
Organization policy with constraint compute.setServiceAccount
Why this is correct
The compute.setServiceAccount organization policy constraint lets administrators define a list of allowed service account emails that can be used when creating Compute Engine instances or changing an instance's service account. When a user attempts to create an instance with a service account outside this list, the request is denied by the policy enforcement point. This directly enforces the requirement that only the authorized service account is used, making it the correct answer.
Go deeper
Related to this question
Learn chapter
Google Compute Engine
Key term
IAM policy
An IAM policy is a set of rules that determines who can access specific cloud resources and what actions they are allowed to perform.
Key term
IAM
Identity and Access Management (IAM) is a framework of policies and technologies that ensures the right individuals have the appropriate access to technology resources.
About these practice questions
One of 769 original ACE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.