You want to prevent users from accidentally deleting a Shared VPC host project. Which organization-level policy constraint should you enable?

The correct answer is B. compute.restrictXpnProjectLienRemoval. https://cloud.google.com/resource-manager/docs/organization-policy/org-policy- constraints#constraints-for-specific-services - constraints/compute.restrictXpnProjectLienRemoval - Restrict shared VPC project lien removal This boolean constraint restricts the set of users that…

Submitted by brentm· Apr 18, 2026Managing operations within a cloud solution environment

Question

You want to prevent users from accidentally deleting a Shared VPC host project. Which organization-level policy constraint should you enable?

Options

Acompute.restrictSharedVpcHostProjects
Bcompute.restrictXpnProjectLienRemoval
Ccompute.restrictSharedVpcSubnetworks
Dcompute.sharedReservationsOwnerProjects

How the community answered

(43 responses)

A
5% (2)
B
70% (30)
C
19% (8)
D
7% (3)

Explanation

https://cloud.google.com/resource-manager/docs/organization-policy/org-policy- constraints#constraints-for-specific-services - constraints/compute.restrictXpnProjectLienRemoval - Restrict shared VPC project lien removal This boolean constraint restricts the set of users that can remove a Shared VPC host project lien without organization-level permission where this constraint is set to True. By default, any user with the permission to update liens can remove a Shared VPC host project lien. Enforcing this constraint requires that permission be granted at the organization level.

Topics

#Shared VPC#Organization Policy#Project Protection#Resource Deletion Prevention

Community Discussion

No community discussion yet for this question.

Full PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice