GCP Professional Cloud Architect Practice Question

Your company's Google Cloud projects are scattered under the "No organization" node because individual engineers created them with personal Gmail accounts. Security leadership wants to enforce company-wide IAM policies, Cloud Audit Logs exports, and Organization Policy constraints from a single root. As the newly appointed cloud architect, what is the most effective first step to establish the required control plane with minimal service disruption?

Grant the security team Project Owner on every existing project and use per-project IAM and Organization Policy updates scripted through Deployment Manager.
Set up a dedicated host project with Shared VPC and force all teams to attach their service projects to it for centralized control.
Provision Cloud Identity (or Google Workspace) for the company's verified domain to automatically create an Organization resource, then migrate the existing projects under it.
Create a top-level folder called "Corp-Root", move all projects into it, and apply IAM and Organization Policy at the folder level.

Report Issue

Answer Description

Google Cloud lets enterprises anchor all resources under an Organization node that is automatically created when the company provisions a Cloud Identity or Google Workspace account and verifies its primary domain. Projects that currently reside under the "No organization" node cannot inherit org-level IAM or Organization Policy constraints, so central governance is impossible until an Organization resource exists. Therefore, the correct first action is to create (or enable) Cloud Identity or Google Workspace for the corporate domain, which automatically provisions the Organization resource. You can then migrate each existing project into that Organization and optionally create folders to mirror business units.

Incorrect answers:

Moving projects into a top-level folder is impossible without an Organization node because folders must be children of an Organization.
Granting security admins roles on every individual project scales poorly and does not provide a single inheritance point.
A shared VPC host project improves network segmentation but does not create an Organization resource or solve centralized policy enforcement.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.