Google
ASSOCIATE-CLOUD-ENGINEER · Question #277
During a recent audit of your existing Google Cloud resources, you discovered several users with email addresses outside of your Google Workspace domain. You want to ensure that your resources are…
The correct answer is D. Set an organizational policy constraint to limit identities by domain, and then retroactively remove. The domain restriction constraint is not retroactive. Once a domain restriction is set, this limitation will apply to IAM policy changes made from that point forward, and not to any previous changes…
Submitted by thandi_sa· Mar 30, 2026Configuring access and security
Question
During a recent audit of your existing Google Cloud resources, you discovered several users with email addresses outside of your Google Workspace domain. You want to ensure that your resources are only shared with users whose email addresses match your domain. You need to remove any mismatched users, and you want to avoid having to audit your resources to identify mismatched users. What should you do?
Options
- ACreate a Cloud Scheduler task to regularly scan your projects and delete mismatched users.
- BCreate a Cloud Scheduler task to regularly scan your resources and delete mismatched users.
- CSet an organizational policy constraint to limit identities by domain to automatically remove
- DSet an organizational policy constraint to limit identities by domain, and then retroactively remove
How the community answered
(51 responses)- A8% (4)
- B6% (3)
- C22% (11)
- D65% (33)
Explanation
The domain restriction constraint is not retroactive. Once a domain restriction is set, this limitation will apply to IAM policy changes made from that point forward, and not to any previous changes. https://cloud.google.com/resource-manager/docs/organization-policy/restricting-domains
Topics
#organization policy#domain restriction#identity management#IAM cleanup
Community Discussion
No community discussion yet for this question.