Google Professional Cloud Security Engineer Question 165
Select 2Google Cloud PlatformYour organization is planning to migrate to Google Cloud and wants to ensure proper isolation and access control for its resources. The organization consists of multiple departments, including Finance, Engineering, and Marketing, each requiring their own distinct policies and administrative control. Which of the following approaches should you take when defining the Google Cloud resource hierarchy?
- A
Create a single project and segregate resources for all departments using labels for policy differentiation.
- B
Organize resources by creating separate folders for each department under a single organization node.
- C
Use separate organization nodes for each department to ensure complete isolation.
- D
Apply IAM policies at the folder level to manage department-specific permissions while allowing inheritance to projects.
- E
Avoid using folders and manage all policies directly at the project level for simplicity.
Show answer and explanation
Correct answers: B, D
Explanation
The best approach to define a resource hierarchy in Google Cloud for an organization with multiple departments is to use folders under a single organization node. This allows for logical grouping of resources, consistent policy enforcement, and administrative delegation. By applying IAM policies at the folder level, you can ensure proper access control and inheritance down to the project level, streamlining management while maintaining isolation between departments.
- A. Incorrect.
Using a single project and labels is not sufficient for policy enforcement and administrative control because labels are primarily for resource organization, not policy application.
- B. Correct.
Creating separate folders under a single organization node is the recommended practice for isolating department-specific resources and policies while maintaining a unified organizational structure.
- C. Incorrect.
Google Cloud allows only one organization node per domain, so creating separate organization nodes for each department is not feasible.
- D. Correct.
IAM policies applied at the folder level ensure that permissions are inherited by underlying projects, simplifying management and enforcing consistent policies across a department.
- E. Incorrect.
Managing policies directly at the project level is not scalable or efficient for large organizations with multiple departments, as it becomes difficult to maintain consistency.