Examkin

Question

Difficulty: EasyIdentity and Access Management (IAM) Roles and Resource Hierarchy

A security architect is establishing a new Google Cloud resource hierarchy for an enterprise workload. To ensure proper IAM role inheritance and central governance, arrange the initial administrative setup steps in the correct top-down sequence, starting from the highest scope in the resource hierarchy.

  1. 1Configure central security policies and grant organization-wide governance roles at the Organization node.
  2. 2Create environment-specific Folders under the Organization and apply folder-level IAM role bindings for business units.
  3. 3Provision dedicated Google Cloud Projects inside the appropriate environment Folders.
  4. 4Assign resource-level IAM roles and service account permissions to individual resources within the Projects.

Answer

The correct administrative sequence starts at the Organization node, followed by creating Folders, provisioning Projects within those Folders, and finally granting fine-grained resource-level IAM permissions inside the Projects.
Google Cloud resource hierarchy follows a strict top-down structure: Organization node -> Folders -> Projects -> Resources. IAM permissions granted at parent levels automatically inherit downward to child nodes.

Step-by-Step Solution

1
Identify the top root level of the GCP resource hierarchy.
The Organization node is established at the root level to apply central governance and top-level IAM policies.
Policies applied at the Organization level automatically inherit down to all child folders, projects, and resources.
2
Structure organizational units below the root.
Folders are created under the Organization node to group projects by business unit or environment (e.g., Production, Staging).
Folders inherit Organization policies and pass down combined policy bindings to member projects.
3
Provision resource management containers.
Google Cloud Projects are created inside the designated Folders.
Projects serve as administrative boundaries for resources and inherit policies from parent Folders and the Organization.
4
Configure granular resource access control.
Fine-grained IAM roles and service account permissions are assigned to specific resources inside the Projects.
Resource-level grants enforce least-privilege access on individual workloads.

Key Concept

Google Cloud Resource Hierarchy and Top-Down IAM Policy Inheritance
Rate this question

Topics

Identity and Access Management (IAM) Roles and Resource Hierarchy