PCSE Practice Question: Configuring Access Within a Cloud Solution Environment
An organization wants to enforce that all new projects automatically have a specific set of IAM roles assigned to a security group. What is the best way to achieve this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign the IAM roles to the security group at the organization level.
Use organization policies? No, organization policies enforce constraints on resources, not IAM role bindings. You can use a folder-level IAM policy that applies to all projects in the folder. If all projects are under a folder, assign the roles to the folder. Alternatively, use a custom script via Cloud Asset Inventory or Deployment Manager. The simplest is to assign IAM roles at the organization level, which are inherited by all projects. So assign the security group the necessary roles at the organization node.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an organization policy that requires the roles to be assigned.
Why it's wrong here
Organization policies cannot enforce IAM role assignments.
- ✗
Use a Cloud Function triggered by Cloud Asset Inventory to assign the roles when a new project is created.
Why it's wrong here
A Cloud Function triggered by Cloud Asset Inventory would react to project creation but cannot enforce the assignment before the project becomes active, as the trigger fires after the asset is recorded. This fails the requirement for automatic, immediate enforcement at creation time. It is tempting because Cloud Asset Inventory can detect resource changes, making it a correct choice for auditing or remediating existing misconfigurations rather than preventing them proactively.
- ✓
Assign the IAM roles to the security group at the organization level.
Why this is correct
Organization-level IAM policies are inherited by all folders and projects, ensuring every new project gets the bindings.
- ✗
Use a service account with the Security Admin role to periodically scan and update new projects.
Why it's wrong here
This is reactive and not automatic; also requires a process.
Go deeper
Related to this question
About these practice questions
One of 960 original PCSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.