Google ACE Setting Up a Cloud Solution Environment Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Set an organization policy with a constraint on allowed resource locations

  Why this is correct

  An organization policy with the constraints/gcp-resource-locations constraint defines an explicit allowlist of regions where resources can be created. When set at the organization, folder, or project level, it is enforced synchronously at resource creation time, and any API request targeting a location outside the allowlist is rejected with an error. This is the intended, preventative control for enforcing data residency or regulatory location requirements across Google Cloud.

• ✗

  Create a service account with limited permissions

  Why it's wrong here

  A service account is an identity that workloads and applications use to authenticate and authorize API calls via IAM roles. Granting a service account limited permissions only restricts the actions that particular identity can perform; it has no bearing on the geographic locations where resources may be created. Location restrictions are a governance policy decision, not an identity attribute, so a narrowly-scoped service account can still create resources in any region as long as the granted roles permit those actions.

• ✗

  Set a budget alert that notifies when resources are created outside allowed regions

  Why it's wrong here

  A budget alert monitors actual spend against a monetary threshold and sends notifications (e.g., email or Pub/Sub) when costs exceed that threshold. Budgets are purely reactive and cost-based: they do not inspect the location attribute of resources being created and cannot block provisioning or any other API call. Unlike an org policy, a budget alert only informs you after unauthorized resources already exist and have started incurring charges, so it is not a preventive or location-aware control.

• ✗

  Use IAM roles to restrict which users can create resources in specific regions

  Why it's wrong here

  IAM roles are granted on projects, folders, or organizations and provide permissions such as compute.instances.create, but these permissions are not scoped to specific regions or zones. Although IAM Conditions can evaluate some resource attributes, they do not offer a consistent location dimension for all services and are not designed for location governance. The correct enforcement mechanism for restricting resource locations is an organization policy constraint, not IAM.

Go deeper

Related to this question