PCSE Practice Question: Configuring Access Within a Cloud Solution Environment
A security engineer needs to ensure that all Compute Engine instances in an organization are created with specific CMEK (Customer-Managed Encryption Key) for disk encryption. The engineer wants to enforce this at the organization level. Which three actions are required? (Choose three.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Cloud KMS key ring and encryption key.
To enforce CMEK use, you need to create a custom organization policy constraint that requires the CMEK key resource name. Enabling CMEK via CSEK is different. The constraint must be applied at the organization level. The key must be created in Cloud KMS. The compute engine API must be enabled for policy enforcement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a Cloud KMS key ring and encryption key.
Why this is correct
A CMEK key must exist to be referenced in the constraint.
- ✗
Enable Customer-Supplied Encryption Keys (CSEK) for all instances.
Why it's wrong here
CSEK is different from CMEK; the requirement is CMEK.
- ✓
Apply the policy constraint at the organization level.
Why this is correct
The constraint must be applied at the organization to affect all projects.
- ✗
Ensure the Compute Engine API is disabled for all projects.
Why it's wrong here
The API must be enabled to enforce policies.
- ✓
Create a custom organization policy constraint using the Organization Policy Service.
Why this is correct
Custom constraints can enforce CMEK requirements.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCSE question from scratch — 960 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.