nerdexam
Google

PROFESSIONAL-CLOUD-SECURITY-ENGINEER · Question #191

You have created an OS image that is hardened per your organization's security standards and is being stored in a project managed by the security team. As a Google Cloud administrator, you need to…

The correct answer is B. Grant users the compute.imageUser role in the OS image project. D. Set up an image access organization policy constraint, and list the security team managed project. https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints - constraints/compute.trustedImageProjects This list constraint defines the set of projects that can be used for image storage and disk instantiation for Compute Engine. If this constraint…

Submitted by naveen.iyer· Apr 18, 2026Configuring access within a cloud solution environment

Question

You have created an OS image that is hardened per your organization's security standards and is being stored in a project managed by the security team. As a Google Cloud administrator, you need to make sure all VMs in your Google Cloud organization can only use that specific OS image while minimizing operational overhead. What should you do? (Choose two.)

Options

  • AGrant users the compute.imageUser role in their own projects.
  • BGrant users the compute.imageUser role in the OS image project.
  • CStore the image in every project that is spun up in your organization.
  • DSet up an image access organization policy constraint, and list the security team managed project
  • ERemove VM instance creation permission from users of the projects, and only allow you and your

How the community answered

(28 responses)
  • A
    11% (3)
  • B
    82% (23)
  • C
    7% (2)

Explanation

https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints - constraints/compute.trustedImageProjects This list constraint defines the set of projects that can be used for image storage and disk instantiation for Compute Engine. If this constraint is active, only images from trusted projects will be allowed as the source for boot disks for new instances.

Topics

#IAM#Organization Policy#Image Management#Security Governance

Community Discussion

No community discussion yet for this question.

Full PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice