Cloud Digital Leader How Google Cloud Resources Are Managed Practice Question
An organization needs to enforce that resources in a specific project cannot use certain machine series (e.g., f1-micro) due to performance requirements. They also need to tag resources with an 'environment' label for cost tracking. Which TWO methods should they use? (Choose TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a label 'environment' to each resource for cost tracking
Organization policies (constraints) can be used to restrict resource types, including machine series. Labels are key-value metadata for cost tracking. Tags (formerly network tags) are for firewall rules, not policy enforcement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use resource tags (network tags) to deny f1-micro usage
Why it's wrong here
Resource tags (network tags) are metadata strings attached to VM instances that are used exclusively by VPC firewall rules to select source or destination for applying allow/deny rules. They cannot be used to restrict the machine series or deny creation of an instance with a specific configuration. The correct mechanism for such enforcement is an organization policy constraint like `compute.disableMachineSeries`, not network tags.
- ✓
Add a label 'environment' to each resource for cost tracking
Why this is correct
Labels are key-value pairs that can be applied to all Google Cloud resources and are indexed by Cloud Billing for cost allocation and reporting. Adding an `environment` label to each resource allows the organization to break down costs by environment, ensuring accurate cost tracking and chargeback. This satisfies the requirement of enforcing cost tracking, which labels are specifically designed for.
- ✗
Use Cloud Audit Logs to monitor f1-micro usage and manually enforce
Why it's wrong here
Cloud Audit Logs capture administrative activity and data access events, providing a historical record for monitoring, auditing, and forensic investigation. However, they are a detective control: they can show that an f1-micro instance was created, but they cannot prevent its creation or automatically enforce policy. Relying on manual log review and manual remediation is inefficient, error-prone, and not a native enforcement mechanism.
- ✗
Apply a deny IAM policy to prevent creation of f1-micro instances
Why it's wrong here
IAM deny policies allow you to deny specific IAM permissions, such as `compute.instances.create`, but they cannot restrict the value of the `machineType` field in the create request. IAM conditions can restrict access based on resource attributes like name or tag, but not on machine series. Blocking a specific machine series requires an organizational policy constraint, not an IAM deny policy.
- ✓
Create an organization policy with a compute.disableMachineSeries constraint at the folder or project level
Why this is correct
The `compute.disableMachineSeries` organization policy constraint lets you explicitly deny one or more machine series, such as `f1-micro`, across a folder or project hierarchy. This constraint is enforced at resource creation time and is inherited by all child resources, providing a preventive control that blocks the creation of instances with the forbidden series. It can be configured with `denied_values` to list the machine series that are disallowed, making it the appropriate method for this requirement.
Go deeper
Related to this question
Learn chapter
Machine Learning on Google Cloud
Key term
Project
A project is a temporary endeavor with a defined beginning and end, undertaken to create a unique product, service, or result, managed through specific processes in IT environments.
Key term
Metadata
Metadata is data that describes other data, providing context such as when a file was created, who created it, or its size.
About these practice questions
Courseiva writes every GCDL question from scratch — 829 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.