Google Professional Cloud Security Engineer Question 171
Select 3Google Cloud PlatformYour organization is rapidly expanding and managing hundreds of Google Cloud projects under various departments. To maintain consistent security policies and resource organization, you need to set up a scalable structure for managing folders and projects. Which of the following actions should you take to achieve this goal?
- A
Use an organization node to centrally manage folders and projects.
- B
Apply Identity and Access Management (IAM) policies at the folder level to inherit permissions to child projects.
- C
Directly assign IAM roles to individual resources (e.g., Compute Engine instances) in each project for better granularity.
- D
Use labels on projects to group them logically and enforce security policies.
- E
Set up automated folder and project creation using Deployment Manager or Terraform.
Show answer and explanation
Correct answers: A, B, E
Explanation
To manage folders and projects at scale, it is essential to use a structured approach leveraging the organization node, IAM policies at a higher hierarchy level (like folders), and automation tools for consistent and scalable resource creation. Directly assigning IAM roles to individual resources is not scalable, and labels are not a substitute for hierarchical resource management or policy enforcement.
- A. Correct.
Correct. The organization node is the root node of the Google Cloud resource hierarchy. It allows for centralized management of folders and projects, ensuring consistent security and governance policies.
- B. Correct.
Correct. IAM policies applied at the folder level automatically propagate to all child projects and resources, simplifying permission management and ensuring consistency.
- C. Incorrect.
Incorrect. While directly assigning IAM roles to individual resources offers granularity, it is not scalable or recommended for managing permissions across hundreds of projects.
- D. Incorrect.
Incorrect. Labels are useful for organizing and filtering resources, but they do not enforce security policies or manage the resource hierarchy.
- E. Correct.
Correct. Using infrastructure-as-code tools like Deployment Manager or Terraform helps automate resource creation at scale with predefined policies and configurations.