PCSE Practice Question: Configuring Access Within a Cloud Solution Environment
An organization has a Google Cloud organization node with multiple folders for different departments. A deny policy is set at the organization level to block the use of shielded VM constraints. Later, an allow policy at the folder level grants the compute.instances.create permission. A user in that folder tries to create a new VM without shielded VM enabled. What will happen?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The VM creation fails because the deny policy at the organization level overrides the folder allow policy
Deny policies override allow policies. Since the deny policy at the organization level blocks shielded VM usage, the allow policy at the folder level cannot override it. The VM creation will fail because the deny policy explicitly denies permissions related to shielded VM constraints.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The user can create the VM because the folder allow policy grants compute.instances.create
Why it's wrong here
Deny policies take precedence over allow policies; the deny policy blocks the action.
- ✓
The VM creation fails because the deny policy at the organization level overrides the folder allow policy
Why this is correct
Deny policies are evaluated before allow policies and can deny specific permissions, overriding any allows.
- ✗
The VM is created but without shielded VM because the folder policy allows it
Why it's wrong here
The deny policy blocks creation entirely; it doesn't just disable shielded VM.
- ✗
The VM creation succeeds because allow policies take precedence over deny policies
Why it's wrong here
Deny policies have higher priority than allow policies in Google Cloud IAM.
Go deeper
Related to this question
About these practice questions
One of 960 original PCSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.