Google Professional Cloud Security Engineer Question 166
Single answerGoogle Cloud PlatformYou are designing the resource hierarchy for a large organization with multiple departments. Each department has its own specific projects, and you want to enforce department-specific IAM policies while maintaining central control over billing. How should you structure the resource hierarchy in Google Cloud to meet these requirements?
- A
Create a single organization node, and under it, create folders for each department. Place department-specific projects under the respective folders.
- B
Create separate organization nodes for each department to ensure complete separation and isolate IAM policies.
- C
Create a single organization node, and directly create projects for each department without using folders.
- D
Create individual billing accounts for each department and associate them with separate organization nodes.
Show answer and explanation
Correct answer: A
Explanation
In Google Cloud, the resource hierarchy starts with the organization node, which is the root node for all resources in the organization. To meet the requirements of central billing control and department-specific IAM policies, you should create folders under the organization node for each department. Projects for each department are then placed under the respective folders, enabling logical grouping and the application of IAM policies at the folder level. This approach also ensures that billing remains centrally managed at the organization level.
- A. Correct.
This is the correct answer. Using a single organization node ensures centralized control over billing and allows for hierarchical IAM policy application. Folders are the recommended way to organize department-specific projects and enforce department-specific IAM policies.
- B. Incorrect.
This is incorrect. Google Cloud allows only one organization node per company, and creating separate organization nodes would not be possible for a single organization.
- C. Incorrect.
This is incorrect. While creating projects directly under the organization node is possible, it does not allow for logical grouping or granular IAM control at a department level.
- D. Incorrect.
This is incorrect. Billing accounts are not tied to organization nodes in this way, and this approach does not address the requirement for IAM policy enforcement.