Google ACE Setting Up a Cloud Solution Environment Practice Question
Your company has a production project and a development project. You want to ensure that no one can delete the production project accidentally. Which TWO actions should you take? (Choose 2)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply an organization policy constraint that blocks project deletion.
To prevent accidental deletion, you can set a deletion protection policy at the project level. Additionally, using an organization policy constraint 'constraints/resourcemanager.projectDelete' at the folder or organization level can block deletion. Labels don't prevent deletion. Removing the Owner role from all users would break management. Budget alerts don't prevent deletion.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Apply an organization policy constraint that blocks project deletion.
Why this is correct
Organization policy constraints are centralized guardrails evaluated by Google Cloud Resource Manager before IAM. Applying a boolean constraint such as `constraints/resourcemanager.projectDelete` at the organization or folder level explicitly denies the `resourcemanager.projects.delete` action for every principal, overriding project-level IAM roles. This makes it an authoritative, non-bypassable control that prevents a production project from being deleted from any console or API path.
- ✓
Set a deletion protection policy on the project.
Why this is correct
Deletion protection is a per-project boolean attribute set on the project resource via `resourcemanager.projects.update`. When enabled, both the Cloud Console and the Projects API require a principal to disable deletion protection before the delete call succeeds, adding a deliberate two-step safeguard. This protects against accidental deletion but is not an IAM restriction; a user with the delete permission can remove protection first and then delete.
- ✗
Set a budget alert at 100% of projected spend.
Why it's wrong here
Budget alerts are billing notifications configured in Cloud Billing to monitor spend against a threshold and send email alerts when crossed. They operate entirely in the billing subsystem and have no effect on Resource Manager lifecycle operations such as project deletion. Reaching or exceeding 100% of projected spend simply triggers an alert; it does not revoke any IAM permission or block delete requests.
- ✗
Remove the Owner role from all users and grant only Editor.
Why it's wrong here
The Editor role includes the `resourcemanager.projects.delete` permission exactly as Owner does, so Editors can delete projects that have deletion protection disabled. Removing Owner from all users and granting only Editor does not eliminate the delete capability; it only removes Owner-specific powers like managing IAM policies. A proper safeguard would be to restrict the delete permission via a custom role or apply an organizational policy constraint.
- ✗
Add a label to the project indicating it is production.
Why it's wrong here
Labels are metadata represented as key-value pairs attached to a project for cost tracking, grouping, and filtering in the Cloud Console and exported billing data. They are not evaluated by Resource Manager IAM or policy logic, so they carry no enforcement power. Adding `production:true` merely helps identify the project; it cannot prevent or block a project deletion request in any way.
Go deeper
Related to this question
Learn chapter
GCP Cost Management
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
Key term
Folder
A folder is a logical container used to organize and group digital files, resources, or cloud-based assets within a system or platform.
About these practice questions
One of 769 original ACE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.