easyMultiple ChoiceObjective-mapped
Google ACE Practice Question: Ensure that all Cloud Storage buckets in your…
You want to ensure that all Cloud Storage buckets in your organization require customer-managed encryption keys (CMEK). What is the most efficient way to enforce this?
⚠ Common exam trap
Google Cloud often tests the distinction between monitoring (Audit Logs) and enforcement (Organization Policies), and the trap here is that candidates may think monitoring is sufficient for compliance, when in fact only a proactive policy constraint can prevent non-compliant resources from being created.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an Organization Policy with constraint 'storage.requireCustomerManagedEncryption'.
The Organization Policy constraint 'storage.requireCustomerManagedEncryption' is a centralized, scalable way to enforce CMEK across all Cloud Storage buckets in the organization. This policy is applied at the organization or folder level and automatically prevents the creation of new buckets without CMEK, while also blocking updates to existing non-compliant buckets. It is the most efficient method as it requires no per-bucket configuration or ongoing monitoring.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Cloud Audit Logs to monitor for non-compliant buckets.
Why it's wrong here
Cloud Audit Logs record data-access and admin-activity events, including bucket creation and encryption key metadata, but they are strictly a detective control. They cannot block a non-compliant bucket from being created; at best, they alert you after the fact, requiring manual remediation. Because the goal is to *ensure* all buckets are compliant, you need a preventive enforcement mechanism, not log monitoring.
- ✓
Create an Organization Policy with constraint 'storage.requireCustomerManagedEncryption'.
Why this is correct
The Organization Policy constraint `storage.requireCustomerManagedEncryption` is a boolean, preventive constraint that is evaluated by Cloud Resource Manager during bucket creation and update requests. Setting this constraint at the organization level forces every bucket in the hierarchy to specify a CMEK (Customer-Managed Encryption Key) from Cloud KMS or the request is rejected. This gives a centralized, automated guarantee of compliance without per-bucket manual configuration.
- ✗
Use a service account to encrypt all objects with CMEK.
Why it's wrong here
A service account is an identity, not an enforcement policy. Even if you use a service account to programmatically encrypt objects with a CMEK, that does not prevent a principal from creating a bucket without CMEK or uploading objects with default encryption. Additionally, the service account's permission scope only affects what that account can do; it imposes no requirement on other actors or on the bucket creation process.
- ✗
Set a bucket policy on each bucket to require CMEK.
Why it's wrong here
Bucket IAM policies control access to the bucket and its objects—they cannot express an encryption requirement. You would have to manually apply a policy to each existing and future bucket, but the creation of non-compliant buckets cannot be blocked by a bucket policy. An effective org-wide enforcement must happen at the Organization Policy layer, which is evaluated before a bucket exists and applies uniformly.
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
Key term
Cloud storage
Cloud storage is a service that lets you save data on remote servers accessed over the internet instead of on your computer's hard drive.
About these practice questions
Courseiva writes every ACE question from scratch — 769 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.