Cloud Digital Leader How Google Cloud Resources Are Managed Practice Question
A company has applied a deny organization policy at the folder level that prevents the use of certain machine series. An IAM policy at the project level grants a user the role of compute.instanceAdmin. The user attempts to create a VM using a denied machine series. What will happen?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The VM creation is blocked by the deny policy at the folder level.
Deny policies within organization policies override allow policies, including IAM roles. The deny at the folder level will block the VM creation even if the user has the necessary IAM permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The user is prompted to request a quota increase.
Why it's wrong here
Quota increase requests address capacity limits, such as the maximum number of CPUs or persistent disks a project may consume. An organization policy deny constraint, however, is a mandatory governance control that blocks an action before resource creation begins; hitting it does not trigger a quota prompt but instead returns an error directly from the API. Therefore, asking the user to request a quota increase confuses a resource-limit scenario with a policy-enforcement scenario.
- ✓
The VM creation is blocked by the deny policy at the folder level.
Why this is correct
VM creation is blocked because organization policy constraints are evaluated as hard restrictions that take precedence over any IAM grants. When a folder-level deny policy exists, the Cloud Resource Manager component rejects the compute.instance.create call immediately, regardless of which roles the user holds. The deny is deterministic and cannot be bypassed by IAM permissions, so the only possible outcome is a failed creation request.
- ✗
The VM is created successfully because the IAM policy allows it.
Why it's wrong here
IAM policies define who is authorized to perform an action, but organization policies define whether the service itself is allowed to operate in a given context. In this case, the folder-level deny acts as an overarching veto, meaning the effective decision is to deny the VM creation even though the IAM policy grants the user the necessary role. Thus, the fact that the IAM policy allows the action is irrelevant because the deny policy is always evaluated and enforced first.
- ✗
The deny policy is overridden by the project-level IAM policy.
Why it's wrong here
Organization policy constraints are hierarchical and must be satisfied independently of IAM; they cannot be overridden by any IAM policy, including at the project level. When a folder-level deny is set, it inherits down to all projects within that folder, and a project-level IAM grant only affects identity-based permissions, not governance constraints. In fact, deny policies take precedence even over IAM deny rules, so a project-level IAM allow is far too weak to nullify the folder constraint.
Go deeper
Related to this question
Learn chapter
Compute Options on Google Cloud
Key term
IAM
Identity and Access Management (IAM) is a framework of policies and technologies that ensures the right individuals have the appropriate access to technology resources.
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
About these practice questions
One of 829 original GCDL practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.