Google PCA Manage implementation of cloud architecture Practice Question

Exhibit

{
 "textPayload": "Error 403: The caller does not have permission to access the resource. Request prohibited by organization's policy. [ORGANIZATION_POLICY: constraints/iam.allowedPolicyMemberDomains]"
}

Refer to the exhibit. A cloud administrator is attempting to grant the BigQuery Data Viewer role to an external user (user@example.com) but receives the error shown. What is the most likely cause?

⚠ Common exam trap

Google often tests the distinction between IAM permission errors and organization policy constraints, where candidates mistakenly focus on the administrator's permissions (Option C) rather than the broader policy that blocks external members.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The organization policy constraints/iam.allowedPolicyMemberDomains blocks external domains.

The error indicates that the organization's policy constraints/iam.allowedPolicyMemberDomains is blocking the addition of an external user. This constraint restricts IAM policy bindings to only allow members from specified domains, and since user@example.com is from an external domain, the binding is denied. The error message directly references this constraint, making it the most likely cause.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The organization policy constraints/iam.allowedPolicyMemberDomains blocks external domains.
Why this is correct
The constraint `constraints/iam.allowedPolicyMemberDomains` restricts which identity domains may appear in IAM policy bindings. Because `user@example.com` sits outside the permitted Workspace or Cloud Identity customer, the binding is rejected outright, matching the stem's failure to grant BigQuery Data Viewer to that external account.
✗
The BigQuery dataset requires domain-wide delegation.
Why it's wrong here
Domain-wide delegation applies to service accounts acting on behalf of Workspace users, not to granting BigQuery roles to an external identity. It tempts because delegation is used when a service account must impersonate users across a domain, which would be correct for accessing user data without individual consent.
✗
The user does not have the resourcemanager.projects.setIamPolicy permission.
Why it's wrong here
The administrator is granting a role, so the missing permission would be on their own account, not the external user's; the recipient's permissions are irrelevant to the failure. It tempts because setIamPolicy is genuinely required to modify a project's IAM policy, and that would be the cause if the administrator themselves lacked it.
✗
The external user must first be added to a Google Group.
Why it's wrong here
Google Cloud grants IAM roles directly to external identities; group membership is not a prerequisite, so this does not explain the error. It tempts because groups are a common way to manage access at scale, and adding the user to a group would be the right approach when centralising permissions across many principals.

Go deeper

Google PCA Manage implementation of cloud architecture Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question