Google Professional Cloud Security Engineer Question 172
Select 3Google Cloud PlatformYour organization needs to set up an enterprise-level folder and project hierarchy in Google Cloud to manage permissions and resource quotas effectively. The organization has over 200 projects across multiple departments, and each department should have its own folder. Additionally, permissions must be inherited from the organization level down to the project level. Which of the following practices should you adopt to manage folders and projects at scale?
- A
Create a separate folder for each department under the Organization node and assign IAM roles at the folder level.
- B
Assign all IAM roles at the project level to allow fine-grained access control.
- C
Use automated tools like Deployment Manager or Terraform to create and manage folders and projects.
- D
Enable the Organization Policy Service to enforce policies, such as resource constraints, across the folder and project hierarchy.
- E
Avoid using folders and assign IAM roles directly to projects for simplicity.
Show answer and explanation
Correct answers: A, C, D
Explanation
To manage folders and projects at scale in Google Cloud, it is important to create a clear hierarchy with folders for each department, use automation tools for ease of management, and enforce consistent policies using tools like the Organization Policy Service. This approach ensures scalability, simplifies IAM management, and maintains compliance across the resource hierarchy.
- A. Correct.
Correct: Creating a folder for each department under the Organization node is a best practice for organizing resources and managing IAM roles at scale. It allows permissions to be inherited and managed at the folder level, reducing administrative overhead.
- B. Incorrect.
Incorrect: Assigning all IAM roles at the project level does not scale well for large organizations. It creates unnecessary complexity because you would need to manage permissions for each project individually.
- C. Correct.
Correct: Automated tools like Deployment Manager or Terraform can help create and manage folders and projects programmatically, which is essential for managing resources at scale.
- D. Correct.
Correct: The Organization Policy Service enforces consistent policies across your hierarchy, ensuring compliance with resource constraints and security requirements.
- E. Incorrect.
Incorrect: Avoiding folders and assigning IAM roles directly to projects is not a scalable or recommended practice for large organizations. Without folders, permissions cannot be inherited, leading to increased administrative overhead.