Examkin

Question

Difficulty: MediumManaging Cloud Projects and Resource Hierarchy

An Associate Cloud Engineer is tasked with setting up a new isolated environment for a financial analytics team under an existing Google Cloud Organization. The team requires a dedicated workspace where organization policies are pre-enforced before any project is provisioned, and team leads are granted permissions to create projects only within their assigned scope. Place the following administrative steps in the correct sequence to establish this resource hierarchy according to Google Cloud best practices.

  1. 1Create a new dedicated folder named 'Finance-Analytics' under the Organization node using the Resource Manager.
  2. 2Enforce the required Organization Policy constraints directly at the 'Finance-Analytics' folder level.
  3. 3Grant the Project Creator role (roles/resourcemanager.projectCreator) to the financial team leads group scoped specifically to the 'Finance-Analytics' folder.
  4. 4Create the team's first workload project inside the 'Finance-Analytics' folder using the team lead credentials.

Answer

The correct sequence starts with creating the parent folder under the Organization, enforcing Organization Policy constraints on the folder, delegating the Project Creator IAM role to the team leads scoped to that folder, and finally creating the workload project inside the folder.
The correct administrative sequence follows top-down governance: first establish the parent container (Folder), apply security guardrails (Organization Policies) to the container, delegate creation authority (IAM roles) at the folder scope, and finally instantiate child resources (Projects). This ensures all projects are created inside a pre-secured container.

Step-by-Step Solution

1
Provision the parent Folder container
Establishes a structural node in the GCP resource hierarchy under the Organization.
Folders must exist before policy constraints or folder-scoped IAM permissions can be applied.
2
Set Organization Policy constraints on the newly created Folder
Establishes security guardrails at the folder scope.
Configuring constraints prior to project creation guarantees that newly provisioned projects inherit compliance policies immediately upon instantiation.
3
Delegate IAM Project Creator role to team leads at the Folder level
Gives team leads project creation capabilities restricted strictly to the Finance-Analytics folder.
Least privilege dictates granting project creation access on specific folder nodes rather than across the entire organization.
4
Provision the target Project within the Folder container
The project is created inside the folder with inherited folder-level governance.
Project creation occurs last after the container hierarchy, security constraints, and identity permissions are operational.

Key Concept

Resource Hierarchy Provisioning Sequence and IAM/Policy Inheritance
Rate this question

Topics

Managing Cloud Projects and Resource Hierarchy

More questions from this topic