Google ACE Setting Up a Cloud Solution Environment Practice Question

An organization wants to enforce that all projects under a specific folder have a set of constraints, such as disabling default network creation and requiring shielded VMs. What is the most efficient way to achieve this?

⚠ Common exam trap

ACE often tests the misconception that IAM roles or service accounts can enforce resource constraints, when organization policies are the correct tool.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Apply organization policies at the folder level.

Organization policies in Google Cloud can be applied at the folder level, and they are inherited by all projects within that folder. This allows enforcing constraints like disabling default network creation and requiring shielded VMs across all projects efficiently. Applying at the folder level ensures consistent enforcement without per-project configuration.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Use Cloud Shell to run scripts in each project.
Why it's wrong here
Using Cloud Shell to run scripts in each project is a manual, one-time action that does not provide ongoing governance. Even if a script sets the skip_default_network_creation constraint on every current project, any new project created later would remain unconfigured, and the script must be re-run manually or scheduled. This approach is error-prone, lacks central visibility, and does not scale across many folders/projects, so it cannot guarantee consistent enforcement.
✗
Create IAM roles to restrict default network creation.
Why it's wrong here
Creating IAM roles to restrict default network creation is ineffective because IAM governs who is allowed to perform actions, not the configuration outcomes of those actions. No built-in IAM role can specifically disable default network creation during project creation; you could only deny compute.networks.create, which would block all VPC network creation, breaking legitimate workloads. Organization policy constraints are the correct mechanism to set resource configuration guardrails across projects.
✗
Use a service account to enforce policies.
Why it's wrong here
A service account is an identity used by applications, VMs, or automation to authenticate, not a tool to enforce policies. Attaching IAM roles to a service account grants permissions to call APIs, but it does not apply or manage organization policy constraints. Only organization policy, administered via OU/folder/project hierarchy, can enforce configuration rules like skipping default network creation.
✓
Apply organization policies at the folder level.
Why this is correct
Applying organization policies at the folder level is correct because constraints are inherited by all projects and subfolders under that folder. For example, the compute.skipDefaultNetworkCreation constraint can be set at a folder to prevent any project inside it from creating the default VPC network at project creation time. This ensures consistent, centrally managed governance across an entire team or environment without needing to configure each project individually.

Go deeper

Google ACE Setting Up a Cloud Solution Environment Practice Question

Why each option matters

Option-by-option breakdown

Related to this question