Examkin

Question

Difficulty: HardManaging Cloud Projects and Resource Hierarchy

A cloud administrator is configuring a new organizational folder structure for an enterprise application suite. The central deployment team requires authorization to create new Google Cloud projects inside the 'Payments-Production' folder and link those projects to the organization's central billing account. Furthermore, the organization enforces a constraint at the organization root node restricting external IP addresses on Compute Engine instances.

Which of the following statements regarding GCP resource hierarchy management, IAM permissions, and policy enforcement are correct? (Select TWO.)

  1. The deployment team requires the Project Creator role on the target folder and the Billing Account User role on the central billing account to successfully create and link projects.Answer
  2. Organization policies inherited from parent nodes enforce restrictive constraints that cannot be bypassed or overridden by granting IAM roles at lower resource hierarchy levels.Answer
  3. C
    Granting the Project Creator role on the parent folder automatically delegates billing linking permissions for any billing account linked to that folder.
  4. D
    Assigning the primitive Owner role to developers at the project level allows them to disable organization policies inherited from parent folders.
  5. E
    To enable project creation and billing linking under least privilege, the deployment team should be granted the primitive Editor role at the Organization root level.

Answer

The correct statements are that project creation and billing linking require permissions on both the parent container (Project Creator role on the folder) and the billing account (Billing Account User role on the billing account), and that organization policies inherited from parent nodes cannot be overridden by granting lower-level IAM roles.
Project creation within a folder container requires the Project Creator role on that folder, and attaching a project to a billing account requires the Billing Account User role on the billing account. In addition, Organization Policy constraints enforced at upper hierarchy levels define absolute configuration limits that IAM role assignments cannot override.

Step-by-Step Solution

1
Analyze project creation and billing linkage administrative requirements across resource hierarchy levels.
Creating projects inside a specific folder requires project creation permissions scoped to that container, while associating projects with billing requires access permissions on the target billing account resource.
Google Cloud separates IAM permissions for resource hierarchy containers from permissions governing billing account usage.
2
Evaluate the interaction between IAM permission assignments and Organization Policy inheritance.
Organization Policy constraints set at parent hierarchy nodes (such as the Organization root) establish programmatic guardrails that apply regardless of IAM role grants at project or resource levels.
IAM determines who can perform actions on resources, whereas Organization Policies determine what configurations are allowed across the resource hierarchy.
3
Apply the principle of least privilege to role selection.
Assigning fine-grained predefined roles (Project Creator on folder, Billing Account User on billing account) fulfills operational needs without granting unnecessary organization-wide broad access.
Primitive roles (Owner, Editor) at the organization level grant excessive access and violate operational security guidelines.

Key Concept

Managing Google Cloud projects, billing account linkage permissions, least privilege roles, and organization policy inheritance rules across the resource hierarchy.
Rate this question

Topics

Managing Cloud Projects and Resource Hierarchy

More questions from this topic