Google Professional Cloud Security Engineer Question 182
Single answerGoogle Cloud PlatformYour company uses Google Cloud and has a resource hierarchy with the following structure: an organization node, multiple folders for each department, and projects under each folder. The security team wants to ensure that all projects under the 'Finance' folder inherit a policy that restricts access to sensitive data. Where should the team apply the policy to ensure the best security practice while keeping it manageable?
- A
Apply the policy at the organization level.
- B
Apply the policy at the folder level for the 'Finance' folder.
- C
Apply the policy directly to each project under the 'Finance' folder.
- D
Apply the policy individually to each resource within the projects under the 'Finance' folder.
Show answer and explanation
Correct answer: B
Explanation
Policies in Google Cloud are inherited down the resource hierarchy. By applying the policy at the 'Finance' folder level, all projects and resources under the folder automatically inherit the restriction, ensuring consistent security while maintaining manageability. Applying the policy at a higher level (organization) would affect unrelated resources, and applying it at lower levels (projects or individual resources) is inefficient and error-prone.
- A. Incorrect.
Applying the policy at the organization level would unnecessarily apply the restriction to all folders and projects, including unrelated departments, which is not the intended scope of the policy.
- B. Correct.
Applying the policy at the folder level for the 'Finance' folder ensures that all projects under this folder inherit the restriction without affecting other departments or requiring individual project-level configuration.
- C. Incorrect.
Applying the policy directly to each project under the 'Finance' folder would work, but it is less manageable and prone to errors as new projects are created over time.
- D. Incorrect.
Applying the policy individually to each resource within the projects under the 'Finance' folder is overly complex, inefficient, and not a best practice for managing access control in Google Cloud.