PCSE Practice Question: Configuring Access Within a Cloud Solution Environment
A security engineer wants to ensure that only users from a specific external identity provider (IdP) domain (example.com) can access Google Cloud resources. They have configured SAML SSO with the IdP. However, users from other domains are also able to access resources. What is the most effective way to restrict access to only users from example.com?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the Organization Policy constraint constraints/iam.allowedPolicyMemberDomains to only allow domain example.com.
The best approach is to use the Organization Policy constraint 'constraints/iam.allowedPolicyMemberDomains' to restrict which external domains can be members of IAM policies. This prevents users from other domains from being granted roles. Simply blocking at the IdP is not effective because users from other domains could be added as members in IAM. IAM Conditions can be used on role bindings to restrict access based on the user's domain, but this requires careful application to all policies. The organization policy provides a global enforcement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Set the Organization Policy constraint constraints/iam.allowedPolicyMemberDomains to only allow domain example.com.
Why this is correct
This constraint restricts which domains can be used as members in IAM policies, effectively preventing users from other domains from being granted access.
- ✗
Use Cloud Identity groups with membership restricted to example.com and grant access to the group only.
Why it's wrong here
This restricts access to group members but does not prevent adding individual users from other domains to IAM policies directly. The group membership can be restricted, but other IAM bindings could still include external users.
- ✗
Configure the IdP to only assert users from example.com.
Why it's wrong here
The IdP only controls authentication, not authorization. Users from other domains could still be added as members in IAM and log in via other means (e.g., Google accounts).
- ✗
Use IAM Conditions to restrict access to users with a specific claim (e.g., assertion.primary_email ending with @example.com).
Why it's wrong here
IAM Conditions can be used, but they need to be applied to every role binding. They are effective but require more effort and can be overridden by other policies.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCSE question from scratch — 960 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.