Google ACE Setting Up a Cloud Solution Environment Practice Question
An organization wants to enforce a policy that disables the creation of VMs with external IPs across all projects. Which resource hierarchy level should the policy be attached to for maximum coverage?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Organization
Organization policies can be applied at the organization level to affect all projects and folders underneath. This ensures the policy covers all resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Project
Why it's wrong here
Attaching the policy at the project level only governs IAM principals for resources within that single project. Since the organization requires enforcement across all projects, a project-level binding would have to be replicated in every project, and any newly created project would lack the policy until manually updated — making this approach incomplete and error-prone for organization-wide enforcement.
- ✗
Resource (VM)
Why it's wrong here
Compute Engine virtual machines do not accept direct IAM policy bindings; IAM policies are attached to the project, folder, or organization nodes, and permissions for a VM are derived from those ancestor-level bindings. There is no 'setIamPolicy' operation on a VM instance resource, so a policy cannot be attached directly to the VM to enforce anything across the organization.
- ✓
Organization
Why this is correct
The organization node is the root of the GCP resource hierarchy, and it is the correct place to attach an organization-wide policy. Any IAM role binding or organization policy constraint set at this level is inherited by every folder, project, and resource in the hierarchy, thereby ensuring the policy is enforced across all projects while also applying automatically to any future projects created under the organization.
- ✗
Folder
Why it's wrong here
A folder-level policy applies only to the projects that are direct or indirect children of that specific folder, not to projects located elsewhere in the hierarchy. To cover all projects in the organization, you would need to attach the policy to every folder and still risk missing projects that reside directly under the organization node, so this scope is insufficient for the stated requirement.
Go deeper
Related to this question
Learn chapter
GCP Projects, Folders, and Organizations
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
Key term
Resource hierarchy
Resource hierarchy is the structured, parent-child ordering of cloud resources that governs access control, policy inheritance, and resource organization across a cloud platform.
About these practice questions
This ACE question is part of Courseiva's 769-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.