Google Professional Cloud Security Engineer Question 169
Select 2Google Cloud PlatformYour organization has multiple teams that manage projects and folders in Google Cloud. Each team should only have access to their own resources, and you need to provide centralized control over resource hierarchy while allowing teams to self-manage their projects. How can you achieve this at scale?
- A
Use Resource Manager roles at the folder level to assign permissions for each team.
- B
Use Shared VPC to manage access to resources across teams.
- C
Organize projects under separate folders for each team and apply IAM policies at the folder level.
- D
Grant the Organization Admin role to each team so they can manage their own resources independently.
- E
Leverage custom roles to provide granular project-level permissions to each team.
Show answer and explanation
Correct answers: A, C
Explanation
To manage folders and projects at scale, it is crucial to organize resources logically and apply permissions at appropriate levels. Assigning Resource Manager roles at the folder level enables centralized control while allowing teams to manage their specific resources. Organizing projects into folders and applying IAM policies at the folder level ensures scalability, security, and delegation of responsibilities. Other options like Shared VPC, Organization Admin roles, or custom roles do not adequately address the requirements for managing resource hierarchy and access at scale.
- A. Correct.
Assigning Resource Manager roles at the folder level allows you to manage access to resources within folders while maintaining centralized control. This approach ensures that each team has permissions scoped to their specific folder without affecting other teams.
- B. Incorrect.
Shared VPC is used to share networking resources across projects but does not address organizing or managing access to folders and projects at scale.
- C. Correct.
Organizing projects under separate folders and applying IAM policies at the folder level is a scalable way to enforce team-specific access control while maintaining centralized management.
- D. Incorrect.
Granting the Organization Admin role to each team would provide them with excessive permissions, allowing them to manage all resources within the organization, which violates the principle of least privilege.
- E. Incorrect.
Custom roles can provide granular project-level permissions but do not help in managing folders or projects at scale. They are more suited for specific use cases within individual projects.