PCSE Practice Question: Managing Operations in a Cloud Solution Environment
A company wants to enforce that all GKE clusters in their organization use Binary Authorization with a specific attestor. They have multiple projects and want to set this policy centrally. Which approach should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the organization policy service to set a constraint that requires Binary Authorization enforcement across all projects.
Organization policies can enforce constraints at the organization, folder, or project level. The Binary Authorization policy can be set at the organization level using a constraint, but the specific attestor configuration is done via the Binary Authorization API per project. However, to enforce the use of Binary Authorization, you can use an organization policy constraint 'constraints/gcp.restrictBinaryAuthorizationPolicy'.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use the organization policy service to set a constraint that requires Binary Authorization enforcement across all projects.
Why this is correct
Organization policies can enforce that Binary Authorization is enabled and configured.
- ✗
Create a Binary Authorization policy in each project and use a script to apply it.
Why it's wrong here
Manual per-project configuration is not centralized.
- ✗
Create a shared VPC and enable Binary Authorization on the host project.
Why it's wrong here
Binary Authorization is project-specific and not tied to VPC.
- ✗
Use Deployment Manager to deploy Binary Authorization configuration to all projects.
Why it's wrong here
While automated, it is not a policy enforcement mechanism; projects could still disable it.
Go deeper
Related to this question
About these practice questions
This PCSE question is part of Courseiva's 960-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.