GCP Associate Cloud Engineer Practice Question

Your startup currently runs all workloads inside a single Google Cloud project. Leadership now wants every product team to administer its own IAM policies, turn on only the APIs it needs, and receive a distinct monthly bill, while remaining under the same Cloud Identity account. With the least disruption to existing workloads, what should you do?

Register a new Organization resource for each team so their workloads are moved into separate organizations with independent invoices.
Add a separate VPC network for each team within the same project and use network-scoped IAM roles to isolate access and billing.
Create a folder for each team inside the existing project and configure IAM and API settings at the folder level.
Create a dedicated Google Cloud project for each product team, link every new project to the current billing account, and grant team-specific IAM roles and API enablements within its project.

Report Issue

Answer Description

Creating one Google Cloud project for each product team satisfies every stated requirement:

A project is the fundamental container for all Google Cloud resources; IAM policies are defined and evaluated at the project level, so each team can administer access independently.
Service APIs are enabled per project, allowing one team to activate only the Cloud Run API (or any other) without affecting other teams.
Billing is tracked and reported per project. By linking each new project to the existing billing account, you obtain separate cost reports while keeping a single payer.

Folders cannot contain resources directly, so they cannot replace projects. VPC networks live inside projects and do not provide separate IAM or billing boundaries. Creating separate Organization resources is unnecessary overhead and would fragment administration under the same corporate domain. Therefore, separate projects for each team is the correct and most straightforward solution.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.