Cloud Digital Leader How Google Cloud Resources Are Managed Practice Question
An engineer needs to grant a team access to view but not edit Compute Engine instances in a project. They also need to ensure that any new instances created in a folder automatically inherit a policy that denies using certain machine types. Which TWO steps should they take? (Choose TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply an organization policy constraint to the folder to deny certain machine types
IAM roles grant permissions; compute.viewer provides read-only access to Compute resources. Organization policies can be set at the folder level to restrict machine types across all projects within.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Grant the team the 'roles/iam.securityReviewer' role
Why it's wrong here
The roles/iam.securityReviewer role only grants read access to IAM policy bindings and Cloud Audit Logs, not to Compute Engine resource metadata or configuration. It lacks critical permissions such as compute.instances.list and compute.instances.get, so the team could not view VM instances, disks, or other compute resources. Therefore, it does not satisfy the requirement to view Compute Engine resources.
- ✗
Use a deny IAM policy at the project level to block create permissions
Why it's wrong here
A project-level IAM deny policy can block specific create actions, but it affects only that project and its resources; it is not automatically inherited by new projects created under a folder or organization. The requirement demands automatic inheritance for future projects, which calls for an organization policy constraint on the ancestor folder. Additionally, IAM deny policies apply to principals and actions, not to restricting the specific machine types that Compute Engine can use.
- ✓
Apply an organization policy constraint to the folder to deny certain machine types
Why this is correct
An organization policy constraint applied at the folder level, such as compute.vmMachineTypeConstraints, restricts which machine types can be used to create VMs across all descendant projects. Folder-level organization policies are inherited by every project and resource within the folder, so any new project added later automatically receives the same restriction without per-project configuration. This centrally enforces the requirement to deny certain machine types while allowing the team to view but not edit.
- ✗
Set a quota for the machine type at the project level
Why it's wrong here
Quotas are numeric usage limits applied per project and per region; they do not act as an authorization layer for specific machine types or actions. Setting a quota at the project level would only cap the number of instances that can be created, and it would not apply to other projects in the folder or affect the ability to edit existing instances. Quotas also do not deny machine types in a permanent or inherited way, so they fail to meet the requirement.
- ✓
Grant the team the 'roles/compute.viewer' role at the project level
Why this is correct
The roles/compute.viewer role includes read-only permissions such as compute.instances.get, compute.instances.list, compute.disks.list, and compute.networks.list, granting the team full visibility into Compute Engine resources without allowing modifications. Granting this role at the project level covers all current and future resources within that project. This directly satisfies the 'view but not edit' access requirement for the team.
Go deeper
Related to this question
Learn chapter
Compute Options on Google Cloud
Key term
View
A view is a saved query in a database that acts like a virtual table, letting you see specific data without storing it separately.
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
About these practice questions
This GCDL question is part of Courseiva's 829-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.