Google Professional Cloud Security Engineer Question 164
Single answerGoogle Cloud PlatformYour organization is planning to migrate its workloads to Google Cloud and needs a resource hierarchy design that ensures proper management, access control, and cost tracking. The following requirements must be met:
- Different teams (Finance, Engineering, and Marketing) need isolated environments for workloads.
- Centralized IAM policies should apply across all teams.
- Projects must be linked to billing accounts to track costs per team.
- The hierarchy must support the potential future addition of new teams or departments.
How should you define the resource hierarchy to meet these requirements?
- A
Create a single organization node, then create folders for each team under it, and assign projects under the respective folders.
- B
Create separate organization nodes for each team, with projects assigned directly under each organization node.
- C
Create a single folder at the root level and assign all projects for all teams into this folder.
- D
Create a single organization node with all projects assigned directly under it, without folders.
Show answer and explanation
Correct answer: A
Explanation
The best practice for defining the resource hierarchy in Google Cloud is to use a single organization node at the root level, with folders underneath to represent teams (e.g., Finance, Engineering, and Marketing). This structure allows centralized IAM management at the organization level while maintaining isolation and specific IAM policies at the folder level. Projects can then inherit policies from folders and be linked to appropriate billing accounts for cost tracking. This setup also supports scalability for future organizational growth.
- A. Correct.
This is the correct approach. By creating a single organization node, you can enforce centralized IAM policies. Using folders for each team ensures isolation and enables cost tracking since projects can inherit policies and be linked to billing accounts. This structure also supports future scalability by allowing additional folders for new teams.
- B. Incorrect.
Incorrect. Google Cloud allows only one organization node per domain, so creating separate organization nodes for each team is not feasible.
- C. Incorrect.
Incorrect. Assigning all projects directly under a single folder does not maintain team isolation or facilitate proper IAM policy management, especially as the organization scales.
- D. Incorrect.
Incorrect. While using a single organization node is correct, assigning all projects directly under it without folders does not ensure team isolation or scalability, and managing IAM policies would become challenging.