PCSE Practice Question: Configuring Access Within a Cloud Solution Environment
A security engineer needs to prevent users from creating service account keys in a Google Cloud project. The solution must be enforceable across all projects in the organization and should not block other IAM operations. Which approach should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the Organization Policy Service with the constraint constraints/iam.disableServiceAccountKeyCreation.
Organization Policy constraints provide a way to enforce restrictions across the resource hierarchy. The built-in constraint 'constraints/iam.disableServiceAccountKeyCreation' specifically prevents creation of service account keys at the project, folder, or organization level. It does not affect other IAM operations. IAM deny policies can deny specific permissions but are more complex to manage and apply at the org level for this specific use case. Custom roles are not designed for enforcement across projects. The Organization Policy Service is the correct choice for such organization-wide restrictions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use IAM Conditions to restrict service account key creation to only a specific project.
Why it's wrong here
IAM Conditions apply to role bindings, not to prevent creation globally. They cannot block key creation across all projects in an organization without complex per-project configuration.
- ✗
Create a custom role that excludes the permission iam.serviceAccountKeys.create and assign it to all users.
Why it's wrong here
Custom roles cannot be enforced across all users; users with other roles (like Owner) would still have the permission. Also, this does not prevent creation of keys via service accounts themselves.
- ✓
Use the Organization Policy Service with the constraint constraints/iam.disableServiceAccountKeyCreation.
Why this is correct
This is the correct method. The built-in constraint specifically disables service account key creation across the resource hierarchy.
- ✗
Create an IAM deny policy at the organization level to deny the permission iam.serviceAccountKeys.create.
Why it's wrong here
While an IAM deny policy at the organisation level would deny the `iam.serviceAccountKeys.create` permission, it is not the most precise mechanism for this scenario. Deny policies are primarily for overriding allow policies for specific principals and permissions. For enforcing a blanket resource behaviour control, such as preventing the creation of service account keys across all projects, an Organization Policy with a custom constraint is the dedicated and more robust approach. This option is tempting because deny policies *can* prevent actions, and they are suitable for fine-grained permission denials for specific identities or groups, especially when overriding broad allow policies.
Go deeper
Related to this question
About these practice questions
One of 960 original PCSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.