Cloud Digital Leader How Google Cloud Resources Are Managed Practice Question
An organization wants to enforce that all Compute Engine instances must have a label 'environment' set to 'production', 'staging', or 'development'. They also want to ensure that instances in the 'production' folder cannot be created with public IP addresses. Which THREE steps should they take? (Choose 3)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use IAM conditions to deny the compute.instances.create permission without the label.
The correct steps are options A, C, and E. Option A uses IAM conditions to deny the compute.instances.create permission if the required 'environment' label is not present, directly enforcing the labeling requirement. Option C uses an organization policy constraint to prohibit external IP addresses on Compute Engine instances in the production folder, preventing public IPs. Option E uses a custom organization policy constraint to require the 'environment' label on all Compute Engine instances. Option B is incorrect because VPC Service Controls restrict data exfiltration, not the creation of instances with public IPs. Option D is incorrect because automatically applying labels via a Cloud Function is a remediation approach, not an enforcement mechanism; the policy constraints and IAM conditions are the appropriate enforcement tools.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use IAM conditions to deny the compute.instances.create permission without the label.
Why this is correct
IAM conditions can deny the compute.instances.create permission unless the request includes an 'environment' label, effectively forcing callers to specify the label via conditional access. This works for individual principals or groups, but it becomes hard to maintain as you must attach conditions to every relevant role binding and it does not cover other API pathways or built-in roles.
- ✗
Set up VPC Service Controls to restrict access to the production VPC.
Why it's wrong here
VPC Service Controls builds a security perimeter that restricts data movement to and from Google-managed services, preventing data exfiltration; it does not govern instance attributes such as labels or external IP ranges. Therefore, it cannot enforce either the labeling requirement or the no-public-IP rule.
- ✓
Create an organization policy constraint that prohibits external IP addresses on Compute Engine instances in the production folder.
Why this is correct
This organization policy constraint targets a different compliance requirement: it forbids external IP addresses on instances within the production folder by blocking the assignment of an external IP at creation time. It is a correct and efficient enforcement mechanism for public IP prohibition, but it does not enforce the labeling rule.
- ✗
Create a folder for each environment and apply the label automatically using a Cloud Function triggered by Resource Manager events.
Why it's wrong here
This approach is reactive, not preventive: a Cloud Function triggers only after an instance is created, so an unlabeled instance exists in the interim and the label is added post-creation. It also depends on the function's reliability and cannot guarantee that every instance gets the label, especially if the event is missed or the function fails.
- ✓
Create a custom organization policy constraint that requires the 'environment' label on Compute Engine instances.
Why this is correct
A custom organization policy constraint, written with boolean or list syntax, can require that every Compute Engine instance carries the 'environment' label by evaluating the resource at admission time and denying non-compliant create operations. This provides centralized, proactive enforcement across all projects without relying on users or post-hoc remediation.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
Key term
IPS
An Intrusion Prevention System (IPS) is a network security device that monitors traffic in real time and automatically blocks threats before they reach your systems.
About these practice questions
Courseiva writes every GCDL question from scratch — 829 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.