PCSE Practice Question: Configuring Access Within a Cloud Solution Environment
A company needs to allow developers to create and manage custom IAM roles at the project level, but restrict the permissions that can be added to those roles to a predefined list. What should be used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a custom organization policy constraint to define the allowed permissions for custom roles.
Custom roles can be defined at the organization or project level. To restrict the permissions that can be included, use an organization policy with a custom constraint that specifies allowed permissions for custom roles. Roles Administrator (roles/iam.roleAdmin) allows managing all roles. Organization policy constraints like constraints/iam.allowedPolicyMemberDomains restrict member domains, not permissions. The correct approach is to create a custom organization policy constraint that limits the permissions that can be added to a custom role.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Grant the developers the IAM Role Administrator role (roles/iam.roleAdmin) and rely on training to only use allowed permissions.
Why it's wrong here
This grants full control to add any permission, not restricted.
- ✓
Use a custom organization policy constraint to define the allowed permissions for custom roles.
Why this is correct
Custom constraints can restrict which permissions can be included in custom roles.
- ✗
Grant the developers the Project IAM Admin role (roles/resourcemanager.projectIamAdmin) and restrict roles via a deny policy.
Why it's wrong here
Deny policies can block specific permissions, but not easily enforce a whitelist of permissions for custom roles.
- ✗
Use the constraint constraints/iam.allowedPolicyMemberDomains to restrict the domains of members who can be assigned roles.
Why it's wrong here
This restricts member domains, not permissions in roles.
Go deeper
Related to this question
About these practice questions
This PCSE question is part of Courseiva's 960-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.