PCSE Practice Question: Configuring Access Within a Cloud Solution Environment
A company has multiple Google Cloud projects organized under folders by department. The security team wants to enforce a policy that all Compute Engine instances must use Shielded VM features. They need to prevent non-compliant instances from being created. Which action should be taken to enforce this requirement most effectively?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the Organization Policy Service with the constraint constraints/compute.requireShieldedVm.
Organization Policy constraints are the correct mechanism to enforce requirements across the resource hierarchy. The built-in constraint 'constraints/compute.requireShieldedVm' ensures that any new Compute Engine instance must have Shielded VM features enabled. This policy can be applied at the organization, folder, or project level. IAM roles or custom roles cannot enforce instance configuration requirements. Service account impersonation is unrelated. Deny policies can deny specific permissions but not enforce Shielded VM settings.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an IAM deny policy at the organization level that denies the compute.instances.create permission unless the Shielded VM flag is set.
Why it's wrong here
IAM deny policies cannot conditionally deny creation based on instance configuration; they deny specific permissions unconditionally or based on attributes like resource name, not VM settings.
- ✗
Create a custom role that includes the permission to create instances only with Shielded VM, and assign it to all users.
Why it's wrong here
Custom roles cannot enforce that Shielded VM must be enabled; they only grant permissions. Users with other roles could still create non-compliant instances.
- ✓
Use the Organization Policy Service with the constraint constraints/compute.requireShieldedVm.
Why this is correct
This built-in constraint forces Shielded VM to be required when creating instances. It can be applied at the folder level to cover all projects under a department.
- ✗
Implement a service account that only has permission to create instances and use service account impersonation for all instance creation.
Why it's wrong here
Service account impersonation does not enforce Shielded VM requirements. It only controls who can act as a service account.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCSE question from scratch — 960 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.