Google ACE Setting Up a Cloud Solution Environment Practice Question
An organization wants to enforce that all projects under a specific folder have a set of constraints, such as disabling default network creation and requiring shielded VMs. What is the most efficient way to achieve this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply organization policies at the folder level.
Organization policies can be applied at the folder level, inheriting to all projects within that folder. This is more efficient than applying per project. Using Cloud Shell is irrelevant. IAM cannot enforce such constraints. Service accounts are for authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Cloud Shell to run scripts in each project.
Why it's wrong here
Using Cloud Shell to run scripts in each project is a manual, one-time action that does not provide ongoing governance. Even if a script sets the skip_default_network_creation constraint on every current project, any new project created later would remain unconfigured, and the script must be re-run manually or scheduled. This approach is error-prone, lacks central visibility, and does not scale across many folders/projects, so it cannot guarantee consistent enforcement.
- ✗
Create IAM roles to restrict default network creation.
Why it's wrong here
Creating IAM roles to restrict default network creation is ineffective because IAM governs who is allowed to perform actions, not the configuration outcomes of those actions. No built-in IAM role can specifically disable default network creation during project creation; you could only deny compute.networks.create, which would block all VPC network creation, breaking legitimate workloads. Organization policy constraints are the correct mechanism to set resource configuration guardrails across projects.
- ✗
Use a service account to enforce policies.
Why it's wrong here
A service account is an identity used by applications, VMs, or automation to authenticate, not a tool to enforce policies. Attaching IAM roles to a service account grants permissions to call APIs, but it does not apply or manage organization policy constraints. Only organization policy, administered via OU/folder/project hierarchy, can enforce configuration rules like skipping default network creation.
- ✓
Apply organization policies at the folder level.
Why this is correct
Applying organization policies at the folder level is correct because constraints are inherited by all projects and subfolders under that folder. For example, the compute.skipDefaultNetworkCreation constraint can be set at a folder to prevent any project inside it from creating the default VPC network at project creation time. This ensures consistent, centrally managed governance across an entire team or environment without needing to configure each project individually.
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
IAM
Identity and Access Management (IAM) is a framework of policies and technologies that ensures the right individuals have the appropriate access to technology resources.
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
About these practice questions
This ACE question is part of Courseiva's 769-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.