PCSE Practice Question: Configuring Access Within a Cloud Solution Environment
A security architect is designing an IAM hierarchy for a large organization. The requirements are: 1) Development projects should inherit a policy that allows Compute Engine access. 2) Production projects should not have Compute Engine access. 3) Audit team must be able to read all resources across all projects. Which three IAM policy placements are correct? (Choose three.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Grant the development team roles/compute.admin at the folder level for the development folder.
Grant the development team roles/compute.admin at the development folder level (A) allows development projects to inherit Compute Engine access. Grant the audit team roles/viewer at the organization level (B) allows them to read all resources across all projects. Placing a deny policy at the production folder level (D) blocks Compute Engine access for production projects. This meets all requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Grant the development team roles/compute.admin at the folder level for the development folder.
Why this is correct
Inherited by all projects in the development folder.
- ✓
Grant the audit team roles/viewer at the organization level.
Why this is correct
Viewer role at the org level gives read access to all resources.
- ✗
Grant the production team roles/compute.admin at the folder level for the production folder, then create a deny policy at the org level to block Compute Engine.
Why it's wrong here
Deny at org level would block all projects, including development.
- ✓
Place a deny policy at the production folder level to block Compute Engine access.
Why this is correct
A deny policy at the production folder will block Compute Engine for all projects in that folder.
- ✗
Grant the audit team roles/viewer at each project level.
Why it's wrong here
Inefficient; granting at the org level is better.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCSE question from scratch — 960 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.