Google Professional Cloud Security Engineer Question 168
Select 3Google Cloud PlatformYour organization has recently undergone significant growth, resulting in a large number of Google Cloud projects and folders under your organization. To maintain proper security and compliance while managing resources at scale, which actions should you take to optimize the management of folders and projects in Google Cloud?
- A
Use IAM policies at the organization level to define broad permissions and apply inheritance to folders and projects.
- B
Create custom scripts to manually assign IAM roles for each new project and folder as they are created.
- C
Implement a folder hierarchy based on your organization's business units or functional teams to align with resource ownership and access control needs.
- D
Enable the Resource Manager API to programmatically manage folders and projects at scale.
- E
Grant Editor roles at the project level to all engineers to simplify access management across projects.
Show answer and explanation
Correct answers: A, C, D
Explanation
Managing folders and projects at scale requires a combination of automated tools, well-designed hierarchy, and efficient use of IAM policies to ensure security and compliance. Leveraging the Resource Manager API, defining IAM policies at the organization level, and aligning folder structures with organizational needs are best practices for managing Google Cloud resources at scale. Avoid manual processes and overly permissive roles, as they can lead to inefficiencies and security vulnerabilities.
- A. Correct.
Using IAM policies at the organization level and leveraging inheritance ensures consistent permissions across folders and projects, reducing the need for manual intervention and improving security.
- B. Incorrect.
Manually assigning IAM roles for each new project and folder is inefficient and prone to errors, especially in large organizations. This approach does not scale well.
- C. Correct.
Implementing a folder hierarchy based on business units or functional teams helps organize resources logically and provides a structure for applying access controls systematically.
- D. Correct.
Enabling the Resource Manager API allows you to programmatically manage folders and projects, which is essential for large organizations to automate operations and maintain consistency.
- E. Incorrect.
Granting Editor roles at the project level to all engineers is a poor security practice because it violates the principle of least privilege, potentially exposing sensitive resources to unauthorized actions.