PCSE Practice Question: Configuring Access Within a Cloud Solution Environment
A security engineer needs to prevent creation of long-lived service account keys across all projects in an organization. The solution should also block any existing keys older than 90 days. Which approach meets these requirements?
⚠ Common exam trap
Google Cloud often tests the misconception that custom organization policies can delete existing resources, when in reality they only enforce conditions on new resource creation or updates, not retroactive actions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a deny policy to deny the permission iam.serviceAccountKeys.create and another deny policy to deny use of keys older than 90 days.
Deny policies can be used to prevent creation of new service account keys (by denying iam.serviceAccountKeys.create) and to block use of existing keys older than 90 days (by denying permissions like iam.serviceAccountKeys.signBlob with a condition on key age). This directly addresses both requirements: prevention of new long-lived keys and disabling existing keys older than 90 days. Option A only prevents creation of new keys via the built-in constraint but does not affect existing keys; while a custom policy can enforce key rotation on new keys, it cannot block or disable keys that already exist. Option C fails because custom constraints cannot delete existing resources. Option D does not block key creation via all methods and does not address existing keys.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the built-in constraint constraints/iam.disableServiceAccountKeyCreation and write a custom organization policy to enforce key rotation (max age 90 days).
Why it's wrong here
The built-in constraint prevents creation of new keys, and a custom policy can enforce rotation only on newly created keys, but no mechanism in Option A blocks or disables existing keys older than 90 days. The requirement explicitly includes blocking existing keys, which this option does not achieve.
- ✓
Use a deny policy to deny the permission iam.serviceAccountKeys.create and another deny policy to deny use of keys older than 90 days.
Why this is correct
Deny policies can be applied at the organization level to deny the permission iam.serviceAccountKeys.create, preventing creation of new keys. Additionally, a deny policy with a condition on key age can deny permissions to use existing keys older than 90 days, effectively blocking them.
- ✗
Use a custom organization policy constraint to disable key creation and another custom constraint to delete keys older than 90 days.
Why it's wrong here
Custom constraints can only evaluate conditions during resource creation or update; they cannot trigger deletion of existing resources. Therefore, they cannot delete existing keys older than 90 days.
- ✗
Use a VPC Service Controls perimeter to block access to the IAM API for creating keys.
Why it's wrong here
VPC Service Controls restrict network access but do not prevent key creation through other means (e.g., via console or API from allowed networks) and do not address existing keys.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCSE question from scratch — 960 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.