PCSE Practice Question: Configuring Access Within a Cloud Solution Environment

A security engineer needs to enforce that all Compute Engine VMs in an organization use Shielded VM features. Which approach should they use?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create an organization policy with the constraint constraints/compute.requireShieldedVm set to True.

The organization policy constraint constraints/compute.requireShieldedVm is the correct way to enforce Shielded VM across all VMs.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Use IAP to enforce Shielded VM on all instances.
Why it's wrong here
IAP provides access control, not VM configuration enforcement.
✗
Enable Shielded VM in the project's compute engine settings.
Why it's wrong here
Project settings are not inherited and can be overridden per instance.
✗
Configure a firewall rule to block non-Shielded VMs.
Why it's wrong here
Firewall rules control network traffic, not VM configuration.
✓
Create an organization policy with the constraint constraints/compute.requireShieldedVm set to True.
Why this is correct
The organization policy constraint enforces Shielded VM at the organization level.

Go deeper