Google PCA Design for security and compliance Practice Question
An organization has a security policy that prohibits the use of external IP addresses on Compute Engine instances to reduce attack surface. They want to enforce this policy across all new and existing projects. Which approach should they use?
⚠ Common exam trap
Many exam-takers confuse IAM conditions (which control who can perform an action) with Organization Policy constraints (which control what actions are allowed), leading them to choose IAM conditions as a preventive control when they only provide authorization-level restrictions, not resource-level enforcement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Organization Policy with constraint compute.vmExternalIpAccess
The Organization Policy constraint `compute.vmExternalIpAccess` is the correct approach because it allows you to set a policy at the organization, folder, or project level that denies the assignment of external IP addresses to Compute Engine instances. This policy is enforced at resource creation time and applies to all new and existing VM instances, ensuring compliance with the security policy across the entire resource hierarchy. It directly prevents the use of external IPs, reducing the attack surface without requiring per-project or per-instance configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use Organization Policy with constraint compute.vmExternalIpAccess
Why this is correct
This constraint explicitly prevents creation of VMs with external IPs and can be applied at org level.
- ✗
Use IAM conditions to prevent creation of instances with external IPs
Why it's wrong here
IAM conditions on roles like compute.instanceAdmin can use resource attributes, but cannot easily block external IP assignment.
- ✗
Use Cloud Security Command Center to detect and alert on external IPs
Why it's wrong here
SCC provides visibility but not enforcement; instances may already be exposed.
- ✗
Use VPC Firewall rules to block traffic to external IPs
Why it's wrong here
Firewall rules block traffic but the external IP still exists and could be used internally.
Go deeper
Related to this question
Learn chapter
Google Cloud Resource Hierarchy and Organization
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
Key term
Project
A project is a temporary endeavor with a defined beginning and end, undertaken to create a unique product, service, or result, managed through specific processes in IT environments.
About these practice questions
Courseiva writes every PCA question from scratch — 955 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.