PCSE Practice Question: Configuring Access Within a Cloud Solution Environment
A company has multiple Google Cloud projects under an organization. They want to ensure that only service accounts from their own Cloud Identity domain (example.com) can be used in IAM policies. Which TWO steps should they take? (Choose 2)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Remove any IAM policies that include members from other domains.
The organization policy constraint constraints/iam.allowedPolicyMemberDomains restricts member domains in IAM policies. Setting it to ['example.com'] ensures only principals from that domain can be added. Additionally, removing other domains from existing policies is necessary to enforce the constraint.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure VPC Service Controls to restrict access.
Why it's wrong here
VPC Service Controls prevent data exfiltration, not IAM domain restrictions.
- ✓
Remove any IAM policies that include members from other domains.
Why this is correct
Existing policies with other domains would violate the constraint and cause errors.
- ✗
Use Cloud Identity to block external users.
Why it's wrong here
Cloud Identity manages users, but does not restrict IAM policies.
- ✗
Create a deny policy that denies the resourcemanager.projects.setIamPolicy permission for non-example.com users.
Why it's wrong here
Deny policies are for permissions, not domains.
- ✓
Apply the organization policy constraint constraints/iam.allowedPolicyMemberDomains with value ['example.com'] at the organization level.
Why this is correct
This restricts IAM members to example.com.
Go deeper
Related to this question
About these practice questions
This PCSE question is part of Courseiva's 960-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.