PCSE Practice Question: Configuring Access Within a Cloud Solution Environment
A security team wants to restrict service account key creation in their organization to prevent key-based authentication. They have set the organization policy constraint constraints/iam.disableServiceAccountKeyCreation to True. However, they need to allow a specific project to continue creating keys for legacy applications. Which two steps are required? (Choose two.)
⚠ Common exam trap
A common misconception is that you must remove the constraint from the organization level and reapply it to individual projects. In Google Cloud, you can use hierarchical overrides (e.g., folder-level policy) or organization policy conditions to create targeted exceptions without altering the organization-level policy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set a folder-level policy to disable the constraint for the folder containing the project.
Setting a folder-level policy to disable the constraint for the folder containing the project allows the organization policy to remain enforced at the org level while creating an exception for the specific folder and its child projects. Option E is correct because the organization policy supports conditions, enabling you to add an exception for a specific project without removing the constraint from the organization level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Remove the constraint from the organization level and apply it to all child projects except the legacy one.
Why it's wrong here
This is not a recommended approach; better to use conditions.
- ✗
Use a deny policy to block key creation for all projects except the legacy one.
Why it's wrong here
Deny policies cannot be used to allow exceptions.
- ✗
Create a custom role with iam.serviceAccountKeys.create permission and assign it to the project.
Why it's wrong here
The org policy overrides IAM permissions; even with the permission, the policy blocks key creation.
- ✓
Set a folder-level policy to disable the constraint for the folder containing the project.
Why this is correct
A folder policy can override the org policy if it is less restrictive.
- ✓
Add an exception in the organization policy for the specific project using conditions.
Why this is correct
Organization policies can have conditions to exclude certain resources.
Go deeper
Related to this question
About these practice questions
One of 960 original PCSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.