PCSE Practice Question: Configuring Access Within a Cloud Solution Environment
An organization has multiple GCP projects managed through folders in the resource hierarchy. They want to enforce a policy that prohibits the creation of service account keys across all projects. Which approach should be used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply an organization policy with the constraint 'constraints/iam.disableServiceAccountKeyCreation' at the folder level.
Organization policies can be applied at the folder or organization level to enforce constraints across all projects. The constraint 'constraints/iam.disableServiceAccountKeyCreation' specifically disables service account key creation. Applying it at a folder level is the most efficient way to enforce the policy across all projects in that folder.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a deny policy at the project level to deny the 'iam.serviceAccountKeys.create' permission.
Why it's wrong here
Deny policies can deny permissions, but applying at each project separately is less efficient than a single organization policy at the folder level.
- ✗
Configure a script that runs daily to delete any service account keys found in projects.
Why it's wrong here
This is reactive, not preventive. It does not prevent key creation and can lead to gaps.
- ✗
Create a custom IAM role that denies the permission to create keys and assign it to all users.
Why it's wrong here
IAM roles grant or deny permissions, but managing this at scale across users is inefficient and error-prone. Organization policy is the correct tool.
- ✓
Apply an organization policy with the constraint 'constraints/iam.disableServiceAccountKeyCreation' at the folder level.
Why this is correct
Organization policies enforce restrictions across the resource hierarchy. This constraint disables key creation for all service accounts in the folder's projects.
Go deeper
Related to this question
About these practice questions
This PCSE question is part of Courseiva's 960-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.