Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM) Roles and Resource Hierarchy

An enterprise security team is establishing access governance for a new Google Cloud deployment. In what top-down order should an administrator perform these steps to implement resource hierarchy and IAM permissions according to Google Cloud best practices?

  1. 1Define baseline Organization Policy constraints and IAM roles at the Organization node.
  2. 2Create environment Folders under the Organization node to group related workloads.
  3. 3Provision GCP Projects inside the designated Folders and enable required service APIs.
  4. 4Bind specific predefined or custom IAM roles to principals at the Project or Resource level.

Answer

The correct sequence configures governance top-down starting at the Organization node, establishing Folders for structural grouping, creating Projects within those folders, and finally applying granular least-privilege IAM bindings at the Project or Resource level.
Google Cloud access governance flows down the resource hierarchy: Organization → Folders → Projects → Resources. Defining baseline controls at the Organization level ensures global policy enforcement. Creating Folders allows environment-level grouping. Provisioning Projects provides the compute/storage containers. Finally, assigning granular IAM roles at the Project or Resource level achieves least privilege.

Step-by-Step Solution

1
Configure top-level policy constraints and organization-wide IAM policies at the Organization node.
Establishes baseline security boundaries that inherit across all descendant resources.
Governance best practices require establishing high-level security controls before workload resources are created.
2
Construct environment or department Folders under the Organization node.
Organizes projects into manageable administrative units.
Folders allow applying common IAM roles and organization policies to groups of projects.
3
Deploy individual GCP Projects inside the folder hierarchy.
Provides discrete containers for hosting GCP services and resources.
Projects must exist within folders before service APIs can be enabled and workloads deployed.
4
Assign fine-grained predefined or custom IAM roles at the Project or specific Resource level.
Enforces least-privilege access control tailored to workload needs.
Specific permissions should be granted at the most targeted resource boundary to prevent overly broad privilege propagation.

Key Concept

Google Cloud Resource Hierarchy and IAM Inheritance Governance
Rate this question

Topics

Identity and Access Management (IAM) Roles and Resource Hierarchy