Google ACE IAM Conditions Practice Question

An organization wants to manage GCP resources for multiple teams using a hierarchy of folders and projects. They need to apply a uniform policy that restricts the regions where VM instances can be created across all projects in a folder. Which approach should they use?

⚠ Common exam trap

Candidates may confuse organization policy constraints with IAM policies. While organization policies are designed for such restrictions, IAM conditions can also achieve the same result.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Set an IAM policy on the folder that denies compute.instances.create permission in disallowed regions

The correct approach uses IAM conditions to restrict resource creation based on location. While organization policies with the 'gcp.resource-locations' constraint are the recommended method, option C is the only valid choice among the given options. IAM policies on the folder with conditions can effectively deny compute.instances.create permission in disallowed regions, enforcing uniform control across all projects in the folder.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Apply an organization policy with the `compute.allowedExternalIpAccess` constraint
Why it's wrong here
The compute.allowedExternalIpAccess organization policy constraint determines whether VM instances, forwarding rules, and other resources are allowed to use external IP addresses. It does not evaluate or restrict the location (region) where a VM is created at all. Enabling or disabling it would neither limit VM creation to approved regions nor deny creation in disallowed ones, so it is orthogonal to the stated requirement.
✗
Apply an organization policy with the `compute.restrictResourceCreation` constraint
Why it's wrong here
The compute.restrictResourceCreation constraint lets an administrator control which compute resource types (for example, specific VM machine families or GPU types) can be created, not where they can be created. It can block certain resources entirely, but it cannot express a condition such as 'allow only us-central1'. Because the requirement is a location-based restriction, this constraint has the wrong dimension and would not achieve the intent.
✓
Set an IAM policy on the folder that denies compute.instances.create permission in disallowed regions
Why this is correct
Applying a folder-level IAM deny policy that denies compute.instances.create with a condition on resource.location is the correct approach because IAM conditions are evaluated at access time against the requested resource's attributes. You can specify that the request is denied unless resource.location is one of the allowed regions, and this applies to all projects in the folder. Deny policies override any allow bindings chain-wide, providing deterministic enforcement that works for Console, CLI, and API calls.
✗
Use gcloud config set compute/region and enforce with a script
Why it's wrong here
gcloud config set compute/region only changes the default region for commands run by a single user on a given workstation. A script that runs it cannot enforce the setting on other users, service accounts, or API calls made directly through the Cloud Console or Terraform. It is not a policy mechanism, so it fails to provide centralized, auditable region restrictions across all projects in the organization.

Go deeper

Google ACE IAM Conditions Practice Question

Why each option matters

Option-by-option breakdown

Related to this question