You are responsible for configuring Identity and Access Management in your organization's Google Cloud environment. You need to restrict your organization's users from accessing Cloud Storage…

The correct answer is C. Create an IAM deny policy on the organization level that prevents access to Cloud Storage. An organization-level IAM deny policy can explicitly block access to Cloud Storage buckets not belonging to your organization (e.g., with a condition checking the bucket’s organization != yours), ensuring your users cannot reach external-org buckets regardless of other grants.

Submitted by renata2k· Apr 18, 2026Configuring access within a cloud solution environment

Question

You are responsible for configuring Identity and Access Management in your organization's Google Cloud environment. You need to restrict your organization's users from accessing Cloud Storage buckets in other Google Cloud organizations. What should you do?

Options

ASet a principal access boundary policy with the appropriate enforcement version. Bind the policy to
BConfigure organization restriction headers for your environment. Only include the organization ID
CCreate an IAM deny policy on the organization level that prevents access to Cloud Storage
DEnforce domain restricted sharing in your organization. Configure a managed constraint, and only

How the community answered

(36 responses)

A
3% (1)
B
6% (2)
C
81% (29)
D
11% (4)

Explanation

An organization-level IAM deny policy can explicitly block access to Cloud Storage buckets not belonging to your organization (e.g., with a condition checking the bucket’s organization != yours), ensuring your users cannot reach external-org buckets regardless of other grants.

Topics

#IAM Deny Policies#Organization Policy#Cloud Storage Security#Cross-Organization Access

Community Discussion

No community discussion yet for this question.

Full PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice