The correct answer is that an organization policy constraint is denying the action despite valid IAM permissions. This is because organization policy constraints in Google Cloud operate as a deny-by-default layer that overrides IAM permissions at any level, including organization-level roles. Even when a user holds the compute.instances.create permission, a constraint like constraints/compute.restrictCreateVM can explicitly block instance creation in a specific project, acting as a hard boundary that IAM cannot bypass. On the Google Professional Cloud Security Engineer exam, this tests your understanding of the hierarchy where organization policy is the ultimate gatekeeper, often tripping candidates who assume IAM alone grants access. A common trap is focusing only on role bindings while ignoring policy constraints applied at the folder or project level. Remember the mnemonic: IAM says "yes, you can," but Org Policy says "no, you won't."
PCSE Supporting compliance requirements Practice Question
This PCSE practice question tests your understanding of supporting compliance requirements. Examine the command output carefully: the correct answer depends on what the output actually shows, not on general recall alone. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Network Topology
Refer to the exhibit. A security engineer runs the gcloud command to analyze IAM policy for a user in an organization. The output shows that the user has the 'compute.instances.create' permission via a role at the organization level. However, the user is unable to create Compute Engine instances in a specific project. What is the most likely cause?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An organization policy constraint is denying the creation of Compute Engine instances.
Option C is correct because organization policy constraints in Google Cloud can override IAM permissions at any level. Even if the user has the 'compute.instances.create' permission via an organization-level role, an organization policy constraint (e.g., constraints/compute.vmExternalIpAccess or constraints/compute.restrictCreateVM) can explicitly deny the creation of Compute Engine instances in a specific project. This is a common scenario where IAM allows the action, but organization policy blocks it.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
The user does not have the 'compute.instances.create' permission at the project level.
Why it's wrong here
The command shows the permission is granted at the organization level, which should be inherited.
✗
The user has the permission but through a different role than expected.
Why it's wrong here
The permission is present regardless of role.
✓
An organization policy constraint is denying the creation of Compute Engine instances.
Why this is correct
Organization policies can deny actions even if IAM allows them.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
The user's role is not granted at the project level.
Why it's wrong here
Organization-level roles are inherited by all projects.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Google Cloud often tests the distinction between IAM permissions and organization policy constraints, trapping candidates who assume that having the correct IAM permission at any level is sufficient to perform an action, without considering that organization policies can override IAM.
Trap categories for this question
Command / output trap
The command shows the permission is granted at the organization level, which should be inherited.
Detailed technical explanation
How to think about this question
Organization policy constraints are enforced by the Resource Manager service and are evaluated after IAM permissions. They use a deny-by-default or allow-by-default model depending on the constraint, and they can be applied at the organization, folder, or project level. For example, the constraint 'constraints/compute.restrictCreateVM' can be set to deny all VM creation in a project, regardless of IAM permissions. This is a key difference from IAM, which is an allow-only system; organization policies can explicitly deny actions that IAM would otherwise allow.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Supporting compliance requirements — This question tests Supporting compliance requirements — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: An organization policy constraint is denying the creation of Compute Engine instances. — Option C is correct because organization policy constraints in Google Cloud can override IAM permissions at any level. Even if the user has the 'compute.instances.create' permission via an organization-level role, an organization policy constraint (e.g., constraints/compute.vmExternalIpAccess or constraints/compute.restrictCreateVM) can explicitly deny the creation of Compute Engine instances in a specific project. This is a common scenario where IAM allows the action, but organization policy blocks it.
What should I do if I get this PCSE question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.