Examkin

Question

Difficulty: MediumManaging Cloud Projects and Resource Hierarchy

An organization's platform team needs to create and manage new Google Cloud projects restricted entirely within a designated folder named 'Data Analytics Sandbox'. The platform team must also link any newly created projects to the corporate billing account. Which set of IAM role assignments meets these requirements following the principle of least privilege?

  1. Grant Project Creator (roles/resourcemanager.projectCreator) on the 'Data Analytics Sandbox' folder, and Billing Account User (roles/billing.user) on the corporate billing account.Answer
  2. B
    Grant Owner (roles/owner) on the organization resource node.
  3. C
    Grant Project Creator (roles/resourcemanager.projectCreator) on both the 'Data Analytics Sandbox' folder and the corporate billing account.
  4. D
    Grant Project Creator (roles/resourcemanager.projectCreator) at the organization level and revoke Project Creator permissions on all other sibling folders.

Answer

Grant Project Creator (roles/resourcemanager.projectCreator) on the 'Data Analytics Sandbox' folder, and Billing Account User (roles/billing.user) on the corporate billing account.
Granting Project Creator directly on the target folder restricts project creation to that container, while granting Billing Account User on the billing account provides the explicit authority required to link new projects to corporate billing, perfectly satisfying least privilege.

Step-by-Step Solution

1
Determine project creation scope requirements.
To restrict project creation to a specific folder, grant roles/resourcemanager.projectCreator on that specific folder resource rather than the Organization level.
IAM permissions inherit downward, so folder-scoped assignment limits project creation strictly to that folder.
2
Determine billing account association permissions.
To associate newly created projects with a billing account, assign roles/billing.user on the target billing account resource.
Project creation and billing account linking require distinct permissions; project creators need Billing Account User rights on the billing account itself.

Key Concept

Folder-level IAM delegation and Billing Account linking permissions
Estimated Time:1m 30s
Rate this question

Topics

Managing Cloud Projects and Resource Hierarchy

More questions from this topic